diff options
| author | Gaming4JC <g4jc@hyperbola.info> | 2019-12-02 22:13:37 -0500 |
|---|---|---|
| committer | Gaming4JC <g4jc@hyperbola.info> | 2019-12-02 23:50:22 -0500 |
| commit | afdbdcf701279601bc31ee76a27a648eecaed381 (patch) | |
| tree | 75d775f9c7d116734bee556066d393346e39c04d /mailnews | |
| parent | 13c039eb9e7a335dc6bcf6992156f07af42797ae (diff) | |
| download | aura-central-afdbdcf701279601bc31ee76a27a648eecaed381.tar.gz | |
Bug 1509685 - Add more bounds checking in nsMsgDBView::UpdateDisplayMessage() to avoid crashes
Tag mcp-graveyard/UXP%1311
Diffstat (limited to 'mailnews')
| -rw-r--r-- | mailnews/base/src/nsMsgDBView.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/mailnews/base/src/nsMsgDBView.cpp b/mailnews/base/src/nsMsgDBView.cpp index 6793ba95a..5b82390c0 100644 --- a/mailnews/base/src/nsMsgDBView.cpp +++ b/mailnews/base/src/nsMsgDBView.cpp @@ -1136,6 +1136,8 @@ nsresult nsMsgDBView::UpdateDisplayMessage(nsMsgViewIndex viewPosition) NS_ENSURE_SUCCESS(rv,rv); nsString subject; + if (viewPosition >= (nsMsgViewIndex)m_flags.Length()) + return NS_MSG_INVALID_DBVIEW_INDEX; FetchSubject(msgHdr, m_flags[viewPosition], subject); nsCString keywords; @@ -1148,6 +1150,8 @@ nsresult nsMsgDBView::UpdateDisplayMessage(nsMsgViewIndex viewPosition) if (folder) { + if (viewPosition >= (nsMsgViewIndex)m_keys.Length()) + return NS_MSG_INVALID_DBVIEW_INDEX; rv = folder->SetLastMessageLoaded(m_keys[viewPosition]); NS_ENSURE_SUCCESS(rv,rv); } @@ -1175,6 +1179,8 @@ NS_IMETHODIMP nsMsgDBView::LoadMessageByViewIndex(nsMsgViewIndex aViewIndex) nsCOMPtr<nsIMessenger> messenger (do_QueryReferent(mMessengerWeak)); NS_ENSURE_TRUE(messenger, NS_ERROR_FAILURE); messenger->OpenURL(uri); + if (aViewIndex >= (nsMsgViewIndex)m_keys.Length()) + return NS_MSG_INVALID_DBVIEW_INDEX; m_currentlyDisplayedMsgKey = m_keys[aViewIndex]; m_currentlyDisplayedMsgUri = uri; m_currentlyDisplayedViewIndex = aViewIndex; |