From 0b6d9a47051be9ef4d064c6f7c60717da91d0bc2 Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Thu, 7 Feb 2019 14:08:09 +0100 Subject: Handle pasted data of certain types with an odd length. --- widget/windows/nsClipboard.cpp | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'widget') diff --git a/widget/windows/nsClipboard.cpp b/widget/windows/nsClipboard.cpp index 0db1dd342..432badeb5 100644 --- a/widget/windows/nsClipboard.cpp +++ b/widget/windows/nsClipboard.cpp @@ -283,16 +283,19 @@ nsresult nsClipboard::GetGlobalData(HGLOBAL aHGBL, void ** aData, uint32_t * aLe { // Allocate a new memory buffer and copy the data from global memory. // Recall that win98 allocates to nearest DWORD boundary. As a safety - // precaution, allocate an extra 2 bytes (but don't report them!) and - // null them out to ensure that all of our strlen calls will succeed. + // precaution, allocate an extra 3 bytes (but don't report them in |aLen|!) + // and null them out to ensure that all of our NS_strlen calls will succeed. + // NS_strlen operates on char16_t, so we need 3 NUL bytes to ensure it finds + // a full NUL char16_t when |*aLen| is odd. nsresult result = NS_ERROR_FAILURE; if (aHGBL != nullptr) { LPSTR lpStr = (LPSTR) GlobalLock(aHGBL); DWORD allocSize = GlobalSize(aHGBL); - char* data = static_cast(malloc(allocSize + sizeof(char16_t))); + char* data = static_cast(malloc(allocSize + 3)); if ( data ) { memcpy ( data, lpStr, allocSize ); - data[allocSize] = data[allocSize + 1] = '\0'; // null terminate for safety + data[allocSize] = data[allocSize + 1] = data[allocSize + 2] = + '\0'; // null terminate for safety GlobalUnlock(aHGBL); *aData = data; -- cgit v1.2.3