Bug 1743637 - Fix array out of bounds in nsTextFrame::ToCString r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D132498
2021-12-01 16:32:59 +00:00
parent fd48df6fc2
commit 4ed00f74d6
1 changed files with 1 additions and 2 deletions
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -10255,8 +10255,7 @@ void nsTextFrame::ToCString(nsCString& aBuf,
    return;
  }
  uint32_t fragOffset = AssertedCast<uint32_t>(GetContentOffset());
-  const uint32_t n = fragOffset + contentLength;
-  while (fragOffset < n) {
+  while (fragOffset < AssertedCast<uint32_t>(*aTotalContentLength)) {
    char16_t ch = frag->CharAt(fragOffset++);
    if (ch == '\r') {
      aBuf.AppendLiteral("\\r");