summaryrefslogtreecommitdiffstats
path: root/image/decoders
diff options
context:
space:
mode:
authorPale Moon <git-repo@palemoon.org>2018-05-05 12:20:42 +0200
committerwolfbeast <mcwerewolf@gmail.com>2018-06-07 06:24:53 +0200
commit835749ed6d411f006fe9d90ba7479233dcfe8ec7 (patch)
treeb866ac4ff5315484ce850cff7b9f41c53c76dc80 /image/decoders
parentdc33e920701244600a0cca1d60deb7621288bb5b (diff)
downloadUXP-835749ed6d411f006fe9d90ba7479233dcfe8ec7.tar
UXP-835749ed6d411f006fe9d90ba7479233dcfe8ec7.tar.gz
UXP-835749ed6d411f006fe9d90ba7479233dcfe8ec7.tar.lz
UXP-835749ed6d411f006fe9d90ba7479233dcfe8ec7.tar.xz
UXP-835749ed6d411f006fe9d90ba7479233dcfe8ec7.zip
Perform some sanity checks on nsMozIconURI.
Diffstat (limited to 'image/decoders')
-rw-r--r--image/decoders/icon/nsIconURI.cpp10
1 files changed, 10 insertions, 0 deletions
diff --git a/image/decoders/icon/nsIconURI.cpp b/image/decoders/icon/nsIconURI.cpp
index 632a733fe..473ded218 100644
--- a/image/decoders/icon/nsIconURI.cpp
+++ b/image/decoders/icon/nsIconURI.cpp
@@ -688,7 +688,17 @@ nsMozIconURI::Deserialize(const URIParams& aParams)
mContentType = params.contentType();
mFileName = params.fileName();
mStockIcon = params.stockIcon();
+
+ if (params.iconSize() < -1 ||
+ params.iconSize() >= (int32_t) ArrayLength(kSizeStrings)) {
+ return false;
+ }
mIconSize = params.iconSize();
+
+ if (params.iconState() < -1 ||
+ params.iconState() >= (int32_t) ArrayLength(kStateStrings)) {
+ return false;
+ }
mIconState = params.iconState();
return true;