diff options
| author | Tom Sepez <tsepez@chromium.org> | 2015-05-15 08:44:31 -0700 |
|---|---|---|
| committer | Tom Sepez <tsepez@chromium.org> | 2015-05-15 08:44:31 -0700 |
| commit | 7f3b99a6a78e524613337f42a99b5634c0ad05f8 (patch) | |
| tree | f13654bc0408c72a056b502d3106fd8e28c616e9 /core/include/fxcrt/fx_ucd.h | |
| parent | b60617f5557a037e64876f7495af80573a35cb4f (diff) | |
| download | pdfium-7f3b99a6a78e524613337f42a99b5634c0ad05f8.tar.xz | |
Fix potential UAF in ConcatInPlace.
If ConcatCopy somehow gets a zero nNewlen, it returns early, without
allocating a new m_Data. ConcatInPlace then frees the old one, leaving
m_Data dangling.
Also be concerned about the multiplication in the widestring version.
So use wmemcpy and let the library cope with it.
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1130763007
Diffstat (limited to 'core/include/fxcrt/fx_ucd.h')
0 files changed, 0 insertions, 0 deletions