corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 555462 - Back out changeset a0f0fde99844 for causing a buffer overrun.

Browse Source
This commit is contained in:
Henri Sivonen
2010-03-30 11:21:36 +03:00
parent b7c2781d0e
commit d008649fab
5 changed files with 141 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
parser/html/nsHtml5TreeBuilder.cpp
View File

@@ -193,18 +193,6 @@ nsHtml5TreeBuilder::comment(PRUnichar* buf, PRInt32 start, PRInt32 length)
return;
}
void
nsHtml5TreeBuilder::ensureBufferSpace(PRInt32 addedLength)
{
PRInt32 newCharBufferCapacity = charBufferLen + addedLength;
if (newCharBufferCapacity > charBuffer.length) {
jArray<PRUnichar,PRInt32> newBuf = jArray<PRUnichar,PRInt32>(newCharBufferCapacity);
nsHtml5ArrayCopy::arraycopy(charBuffer, newBuf, charBufferLen);
charBuffer.release();
charBuffer = newBuf;
}
}
void
nsHtml5TreeBuilder::characters(const PRUnichar* buf, PRInt32 start, PRInt32 length)
{
@@ -3074,10 +3062,6 @@ nsHtml5TreeBuilder::clearLastListSlot()
void
nsHtml5TreeBuilder::push(nsHtml5StackNode* node)
{
if (currentPtr == NS_HTML5TREE_BUILDER_STACK_MAX_DEPTH) {
pop();
}
currentPtr++;
if (currentPtr == stack.length) {
jArray<nsHtml5StackNode*,PRInt32> newStack = jArray<nsHtml5StackNode*,PRInt32>(stack.length + 64);
@@ -3092,10 +3076,6 @@ nsHtml5TreeBuilder::push(nsHtml5StackNode* node)
void
nsHtml5TreeBuilder::silentPush(nsHtml5StackNode* node)
{
if (currentPtr == NS_HTML5TREE_BUILDER_STACK_MAX_DEPTH) {
pop();
}
currentPtr++;
if (currentPtr == stack.length) {
jArray<nsHtml5StackNode*,PRInt32> newStack = jArray<nsHtml5StackNode*,PRInt32>(stack.length + 64);
@@ -3743,6 +3723,20 @@ nsHtml5TreeBuilder::appendVoidFormToCurrent(nsHtml5HtmlAttributes* attributes)
elementPopped(kNameSpaceID_XHTML, nsHtml5Atoms::form, elt);
}
void
nsHtml5TreeBuilder::accumulateCharacter(PRUnichar c)
{
PRInt32 newLen = charBufferLen + 1;
if (newLen > charBuffer.length) {
jArray<PRUnichar,PRInt32> newBuf = jArray<PRUnichar,PRInt32>(newLen);
nsHtml5ArrayCopy::arraycopy(charBuffer, newBuf, charBufferLen);
charBuffer.release();
charBuffer = newBuf;
}
charBuffer[charBufferLen] = c;
charBufferLen = newLen;
}
void
nsHtml5TreeBuilder::requestSuspension()
{