110242 - textNode.SubstringData() crash...

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Johnny Stenback (:jst)]

If a positive number is passed as the start of the substring and -1 (or MAX_INT)
is passed as the length mozilla crahses when trying to allocate close to MAX_INT
bytes of storage for the new string. Patch coming up.

Comment 1

[Johnny Stenback (:jst)]

Btw, this bug causes mozilla to crash when loading the official (soon to be
released) W3C DOM test suite.

Comment 2

[Johnny Stenback (:jst)]

Attachment: Proposed fix, don't let integer values wrap...

Comment 3

[Johnny Stenback (:jst)]

Attachment: Same as above, but a bit cleaner...

Comment 4

[Ray Whitmer]

r=rayw

Comment 5

[vidur (gone)]

Comment on attachment 57987 [details] [diff] [review]
Same as above, but a bit cleaner...

sr=vidur

Comment 6

[Christopher Blizzard (:blizzard)]

This has been checked into the 0.9.6 branch.

Comment 7

[Jaime Rodriguez, Jr.]

Adding PDT for tracking and 6.2 branch review purposes.

Comment 8

[Johnny Stenback (:jst)]

This was checked in on the trunk as well, leaving open for possibly landing on
the 6.2 branch...

Comment 9

[Jaime Rodriguez, Jr.]

Pls check this one into the 6.2 branch before 9 am PST = PDT+

Comment 10

[Jaime Rodriguez, Jr.]

In johnny's absence, who feels comfortable checking this into the 6.2 branch?

Comment 11

[Johnny Stenback (:jst)]

I just got back, I'll land this on the branch ASAP.

Comment 12

[Johnny Stenback (:jst)]

Fixed on the 6.2 branch. Marking FIXED.

Comment 13

[Jaime Rodriguez, Jr.]

Thanks Johnny.

Comment 14

[Sivakiran Tummala]

Does not crash on both linux and win2k (2001-11-21-10). 
Should we throw the "INDEX_SIZE_ERR" exception instead of returning till the end 
of the string, like how we are doing if the offset is -1.
Adding the keyword vbranch

Comment 15

[Johnny Stenback (:jst)]

XPConnect should throw an error when a negative value is passed to a method that
takes unsigned values, and there's a bug on that, but no, we should not throw an
error if the numbers of characters requested is higher than the number of
characters available. That's how the DOM spec defines this method.

Comment 16

[Sivakiran Tummala]

Attachment: testcase

Comment 17

[Sivakiran Tummala]

verified on the four platforms  build 2001-11-26-6.2.1

Comment 18

[Sivakiran Tummala]

reopening bug, Does not crash anymore. Returns the substring from the offset to 
the end of the string for negative data. comment # 16 has testcase.
Should throw INDEX_SIZE_ERR. This bug is a regression.

Comment 19

[Johnny Stenback (:jst)]

See comment #15. This bug is FIXED.

Comment 20

[Sivakiran Tummala]

agree, INDEX_SIZE_ERR is another bug. Marking Verified