diff options
| author | Gaming4JC <g4jc@hyperbola.info> | 2019-12-02 22:13:37 -0500 |
|---|---|---|
| committer | Gaming4JC <g4jc@hyperbola.info> | 2019-12-02 23:50:22 -0500 |
| commit | 717be395fda0a4fb9d83afb772a45c5f5fdb5271 (patch) | |
| tree | 75d775f9c7d116734bee556066d393346e39c04d /mailnews | |
| parent | b8a16acae8256f2b3c0ddf5965c9146e0be3f4a0 (diff) | |
| download | UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar.gz UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar.lz UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.tar.xz UXP-717be395fda0a4fb9d83afb772a45c5f5fdb5271.zip | |
Bug 1509685 - Add more bounds checking in nsMsgDBView::UpdateDisplayMessage() to avoid crashes
Tag #1311
Diffstat (limited to 'mailnews')
| -rw-r--r-- | mailnews/base/src/nsMsgDBView.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/mailnews/base/src/nsMsgDBView.cpp b/mailnews/base/src/nsMsgDBView.cpp index 6793ba95a..5b82390c0 100644 --- a/mailnews/base/src/nsMsgDBView.cpp +++ b/mailnews/base/src/nsMsgDBView.cpp @@ -1136,6 +1136,8 @@ nsresult nsMsgDBView::UpdateDisplayMessage(nsMsgViewIndex viewPosition) NS_ENSURE_SUCCESS(rv,rv); nsString subject; + if (viewPosition >= (nsMsgViewIndex)m_flags.Length()) + return NS_MSG_INVALID_DBVIEW_INDEX; FetchSubject(msgHdr, m_flags[viewPosition], subject); nsCString keywords; @@ -1148,6 +1150,8 @@ nsresult nsMsgDBView::UpdateDisplayMessage(nsMsgViewIndex viewPosition) if (folder) { + if (viewPosition >= (nsMsgViewIndex)m_keys.Length()) + return NS_MSG_INVALID_DBVIEW_INDEX; rv = folder->SetLastMessageLoaded(m_keys[viewPosition]); NS_ENSURE_SUCCESS(rv,rv); } @@ -1175,6 +1179,8 @@ NS_IMETHODIMP nsMsgDBView::LoadMessageByViewIndex(nsMsgViewIndex aViewIndex) nsCOMPtr<nsIMessenger> messenger (do_QueryReferent(mMessengerWeak)); NS_ENSURE_TRUE(messenger, NS_ERROR_FAILURE); messenger->OpenURL(uri); + if (aViewIndex >= (nsMsgViewIndex)m_keys.Length()) + return NS_MSG_INVALID_DBVIEW_INDEX; m_currentlyDisplayedMsgKey = m_keys[aViewIndex]; m_currentlyDisplayedMsgUri = uri; m_currentlyDisplayedViewIndex = aViewIndex; |