27 lines
862 B
Diff
27 lines
862 B
Diff
From a928758612e67c4496bd9acf48bf66259c809782 Mon Sep 17 00:00:00 2001
|
|
From: Nika Layzell <nika@thelayzells.com>
|
|
Date: Tue, 07 Jun 2022 17:06:41 +0000 (24 months ago)
|
|
Subject: [PATCH] CVE-2022-34481
|
|
|
|
---
|
|
xpcom/ds/nsTArray.h | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/xpcom/ds/nsTArray.h b/xpcom/ds/nsTArray.h
|
|
index e368968359..61d7586233 100644
|
|
--- a/xpcom/ds/nsTArray.h
|
|
+++ b/xpcom/ds/nsTArray.h
|
|
@@ -2351,6 +2351,9 @@ auto nsTArray_Impl<E, Alloc>::ReplaceElementsAtInternal(index_type aStart,
|
|
if (MOZ_UNLIKELY(aStart > Length())) {
|
|
InvalidArrayIndex_CRASH(aStart, Length());
|
|
}
|
|
+ if (MOZ_UNLIKELY(aCount > Length() - aStart)) {
|
|
+ InvalidArrayIndex_CRASH(aStart + aCount, Length());
|
|
+ }
|
|
|
|
// Adjust memory allocation up-front to catch errors.
|
|
if (!ActualAlloc::Successful(this->template EnsureCapacity<ActualAlloc>(
|
|
--
|
|
2.27.0
|
|
|