This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch tor-browser-91.11.0esr-11.5-1 in repository tor-browser.
commit 27842d5f78706c0a2ecd7ca7056849ad361fd0b0 Author: Nika Layzell nika@thelayzells.com AuthorDate: Tue Jun 7 17:06:41 2022 +0000
Bug 1497246 - Release-check aCount for underflow in ReplaceElementsAt, r=mccr8 a=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D148456 --- xpcom/ds/nsTArray.h | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/xpcom/ds/nsTArray.h b/xpcom/ds/nsTArray.h index 92fe4a46490ea..52bc260a75400 100644 --- a/xpcom/ds/nsTArray.h +++ b/xpcom/ds/nsTArray.h @@ -2461,6 +2461,9 @@ auto nsTArray_Impl<E, Alloc>::ReplaceElementsAtInternal(index_type aStart, if (MOZ_UNLIKELY(aStart > Length())) { InvalidArrayIndex_CRASH(aStart, Length()); } + if (MOZ_UNLIKELY(aCount > Length() - aStart)) { + mozilla::detail::InvalidArrayIndex_CRASH(aStart + aCount, Length()); + }
// Adjust memory allocation up-front to catch errors. if (!ActualAlloc::Successful(this->template EnsureCapacity<ActualAlloc>(