Bug 1376410 - Handle OOM when appending prefix to map r=francois,hchang

MozReview-Commit-ID: 7MOHHAgEI1I
2017-08-11 17:28:40 +08:00
parent 7b8c62df29
commit a63544b5cb
2 changed files with 24 additions and 8 deletions
--- a/toolkit/components/url-classifier/VariableLengthPrefixSet.cpp
+++ b/toolkit/components/url-classifier/VariableLengthPrefixSet.cpp
@@ -315,6 +315,10 @@ VariableLengthPrefixSet::LoadPrefixes(nsIInputStream* in)
    NS_ENSURE_SUCCESS(rv, rv);
    NS_ENSURE_TRUE(read == sizeof(uint8_t), NS_ERROR_FAILURE);

+    if (prefixSize < PREFIX_SIZE || prefixSize > COMPLETE_SIZE) {
+      return NS_ERROR_FILE_CORRUPTED;
+    }
+
    uint32_t stringLength;
    rv = in->Read(reinterpret_cast<char*>(&stringLength), sizeof(uint32_t), &read);
    NS_ENSURE_SUCCESS(rv, rv);