diff options
| author | Tom Sepez <tsepez@chromium.org> | 2015-05-15 09:09:22 -0700 |
|---|---|---|
| committer | Tom Sepez <tsepez@chromium.org> | 2015-05-15 09:09:22 -0700 |
| commit | 861a552af4aa7edb24c600e25a7bf388a1cdb364 (patch) | |
| tree | 156c726317ac50e8876f86fc01bf8a5d3a968785 /core/src/fxcrt/fx_basic_wstring.cpp | |
| parent | be6c8f29b92208f2806b8f70f0320b46500ddd94 (diff) | |
| download | pdfium-861a552af4aa7edb24c600e25a7bf388a1cdb364.tar.xz | |
Merge to XFA: Fix potential UAF in ConcatInPlace.
Original Review URL: https://codereview.chromium.org/1130763007
TBR=thestig@chromium.org
Review URL: https://codereview.chromium.org/1123333004
Diffstat (limited to 'core/src/fxcrt/fx_basic_wstring.cpp')
| -rw-r--r-- | core/src/fxcrt/fx_basic_wstring.cpp | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp index da022053b8..3c54ca983e 100644 --- a/core/src/fxcrt/fx_basic_wstring.cpp +++ b/core/src/fxcrt/fx_basic_wstring.cpp @@ -237,9 +237,7 @@ void CFX_WideString::ConcatInPlace(FX_STRSIZE nSrcLen, FX_LPCWSTR lpszSrcData) return; } if (m_pData->m_nRefs > 1 || m_pData->m_nDataLength + nSrcLen > m_pData->m_nAllocLength) { - StringData* pOldData = m_pData; ConcatCopy(m_pData->m_nDataLength, m_pData->m_String, nSrcLen, lpszSrcData); - pOldData->Release(); } else { FXSYS_memcpy32(m_pData->m_String + m_pData->m_nDataLength, lpszSrcData, nSrcLen * sizeof(FX_WCHAR)); m_pData->m_nDataLength += nSrcLen; @@ -250,14 +248,17 @@ void CFX_WideString::ConcatCopy(FX_STRSIZE nSrc1Len, FX_LPCWSTR lpszSrc1Data, FX_STRSIZE nSrc2Len, FX_LPCWSTR lpszSrc2Data) { FX_STRSIZE nNewLen = nSrc1Len + nSrc2Len; - if (nNewLen == 0) { + if (nNewLen <= 0) { return; } + // Don't release until done copying, might be one of the arguments. + StringData* pOldData = m_pData; m_pData = StringData::Create(nNewLen); if (m_pData) { - FXSYS_memcpy32(m_pData->m_String, lpszSrc1Data, nSrc1Len * sizeof(FX_WCHAR)); - FXSYS_memcpy32(m_pData->m_String + nSrc1Len, lpszSrc2Data, nSrc2Len * sizeof(FX_WCHAR)); + wmemcpy(m_pData->m_String, lpszSrc1Data, nSrc1Len); + wmemcpy(m_pData->m_String + nSrc1Len, lpszSrc2Data, nSrc2Len); } + pOldData->Release(); } void CFX_WideString::CopyBeforeWrite() { |