[tor-commits] [tor-browser] 26/37: Bug 1497246 - Release-check aCount for underflow in ReplaceElementsAt, r=mccr8 a=RyanVM

[gitolite role]

This is an automated email from the git hooks/post-receive script.

richard pushed a commit to branch tor-browser-91.11.0esr-11.5-1
in repository tor-browser.

commit 27842d5f78706c0a2ecd7ca7056849ad361fd0b0
Author: Nika Layzell <nika at thelayzells.com>
AuthorDate: Tue Jun 7 17:06:41 2022 +0000

    Bug 1497246 - Release-check aCount for underflow in ReplaceElementsAt, r=mccr8 a=RyanVM
    
    Differential Revision: https://phabricator.services.mozilla.com/D148456
---
 xpcom/ds/nsTArray.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/xpcom/ds/nsTArray.h b/xpcom/ds/nsTArray.h
index 92fe4a46490ea..52bc260a75400 100644
--- a/xpcom/ds/nsTArray.h
+++ b/xpcom/ds/nsTArray.h
@@ -2461,6 +2461,9 @@ auto nsTArray_Impl<E, Alloc>::ReplaceElementsAtInternal(index_type aStart,
   if (MOZ_UNLIKELY(aStart > Length())) {
     InvalidArrayIndex_CRASH(aStart, Length());
   }
+  if (MOZ_UNLIKELY(aCount > Length() - aStart)) {
+    mozilla::detail::InvalidArrayIndex_CRASH(aStart + aCount, Length());
+  }
 
   // Adjust memory allocation up-front to catch errors.
   if (!ActualAlloc::Successful(this->template EnsureCapacity<ActualAlloc>(

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.