Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(457)

Unified Diff: core/src/fxcrt/fx_basic_wstring.cpp

Issue 1123333004: Merge to XFA: Fix potential UAF in ConcatInPlace. (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@xfa
Patch Set: Created 5 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « core/src/fxcrt/fx_basic_bstring_unittest.cpp ('k') | core/src/fxcrt/fx_basic_wstring_unittest.cpp » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: core/src/fxcrt/fx_basic_wstring.cpp
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp
index da022053b8318acd4227f907d8697a18269d18a6..3c54ca983e7d5f33010e80db88c6b37c52e92f2e 100644
--- a/core/src/fxcrt/fx_basic_wstring.cpp
+++ b/core/src/fxcrt/fx_basic_wstring.cpp
@@ -237,9 +237,7 @@ void CFX_WideString::ConcatInPlace(FX_STRSIZE nSrcLen, FX_LPCWSTR lpszSrcData)
return;
}
if (m_pData->m_nRefs > 1 || m_pData->m_nDataLength + nSrcLen > m_pData->m_nAllocLength) {
- StringData* pOldData = m_pData;
ConcatCopy(m_pData->m_nDataLength, m_pData->m_String, nSrcLen, lpszSrcData);
- pOldData->Release();
} else {
FXSYS_memcpy32(m_pData->m_String + m_pData->m_nDataLength, lpszSrcData, nSrcLen * sizeof(FX_WCHAR));
m_pData->m_nDataLength += nSrcLen;
@@ -250,14 +248,17 @@ void CFX_WideString::ConcatCopy(FX_STRSIZE nSrc1Len, FX_LPCWSTR lpszSrc1Data,
FX_STRSIZE nSrc2Len, FX_LPCWSTR lpszSrc2Data)
{
FX_STRSIZE nNewLen = nSrc1Len + nSrc2Len;
- if (nNewLen == 0) {
+ if (nNewLen <= 0) {
return;
}
+ // Don't release until done copying, might be one of the arguments.
+ StringData* pOldData = m_pData;
m_pData = StringData::Create(nNewLen);
if (m_pData) {
- FXSYS_memcpy32(m_pData->m_String, lpszSrc1Data, nSrc1Len * sizeof(FX_WCHAR));
- FXSYS_memcpy32(m_pData->m_String + nSrc1Len, lpszSrc2Data, nSrc2Len * sizeof(FX_WCHAR));
+ wmemcpy(m_pData->m_String, lpszSrc1Data, nSrc1Len);
+ wmemcpy(m_pData->m_String + nSrc1Len, lpszSrc2Data, nSrc2Len);
}
+ pOldData->Release();
}
void CFX_WideString::CopyBeforeWrite()
{
« no previous file with comments | « core/src/fxcrt/fx_basic_bstring_unittest.cpp ('k') | core/src/fxcrt/fx_basic_wstring_unittest.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698