summaryrefslogtreecommitdiffstats
path: root/mailnews/base
diff options
context:
space:
mode:
authorGaming4JC <g4jc@hyperbola.info>2019-12-02 22:13:37 -0500
committerGaming4JC <g4jc@hyperbola.info>2019-12-02 23:50:22 -0500
commit717be395fda0a4fb9d83afb772a45c5f5fdb5271 (patch)
tree75d775f9c7d116734bee556066d393346e39c04d /mailnews/base
parentb8a16acae8256f2b3c0ddf5965c9146e0be3f4a0 (diff)
downloadUXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar
UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar.gz
UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar.lz
UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar.xz
UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.zip
Bug 1509685 - Add more bounds checking in nsMsgDBView::UpdateDisplayMessage() to avoid crashes
Tag #1311
Diffstat (limited to 'mailnews/base')
-rw-r--r--mailnews/base/src/nsMsgDBView.cpp6
1 files changed, 6 insertions, 0 deletions
diff --git a/mailnews/base/src/nsMsgDBView.cpp b/mailnews/base/src/nsMsgDBView.cpp
index 6793ba95a..5b82390c0 100644
--- a/mailnews/base/src/nsMsgDBView.cpp
+++ b/mailnews/base/src/nsMsgDBView.cpp
@@ -1136,6 +1136,8 @@ nsresult nsMsgDBView::UpdateDisplayMessage(nsMsgViewIndex viewPosition)
NS_ENSURE_SUCCESS(rv,rv);
nsString subject;
+ if (viewPosition >= (nsMsgViewIndex)m_flags.Length())
+ return NS_MSG_INVALID_DBVIEW_INDEX;
FetchSubject(msgHdr, m_flags[viewPosition], subject);
nsCString keywords;
@@ -1148,6 +1150,8 @@ nsresult nsMsgDBView::UpdateDisplayMessage(nsMsgViewIndex viewPosition)
if (folder)
{
+ if (viewPosition >= (nsMsgViewIndex)m_keys.Length())
+ return NS_MSG_INVALID_DBVIEW_INDEX;
rv = folder->SetLastMessageLoaded(m_keys[viewPosition]);
NS_ENSURE_SUCCESS(rv,rv);
}
@@ -1175,6 +1179,8 @@ NS_IMETHODIMP nsMsgDBView::LoadMessageByViewIndex(nsMsgViewIndex aViewIndex)
nsCOMPtr<nsIMessenger> messenger (do_QueryReferent(mMessengerWeak));
NS_ENSURE_TRUE(messenger, NS_ERROR_FAILURE);
messenger->OpenURL(uri);
+ if (aViewIndex >= (nsMsgViewIndex)m_keys.Length())
+ return NS_MSG_INVALID_DBVIEW_INDEX;
m_currentlyDisplayedMsgKey = m_keys[aViewIndex];
m_currentlyDisplayedMsgUri = uri;
m_currentlyDisplayedViewIndex = aViewIndex;