160784 - nsIUnicodeDecoder::Convert can out a negative aSrcLength, but caller may not be able to back up

Status: RESOLVED FIXED

(Core :: Internationalization, defect)

Description

[Boris Zbarsky [:bzbarsky]]

The issue comes up when:

1)  The caller of Convert is using multiple byte buffers
2)  The data has an error that prevents proper decoding (an invalid byte sequence)
3)  The erroneous data spans a buffer boundary.

When the decoder determines that the byte sequence is invalid, it sets
aSrcLength negative to make the caller rewind to the start of the byte sequence.
 However, the caller may no longer have the beginning of the sequence, since it
was at the end of the previous buffer and the decoder said it consumed it. Thus
the caller is unable to rewind to the beginning of the erroneous sequence.

This problem affects nsConverterInputStream and the HTML scanner at the moment.

Comment 1

[Rui Xu]

code issue, QA to [e-mail] for now.

Comment 2

[Frank Tang]

what a hack. I have not touch mozilla code for 2 years. I didn't read these bugs
for 2 years. And they are still there. Just close them as won't fix to clean up.

Comment 3

[Travis Chase]

Mass Reassign Please excuse the spam

Comment 4

[Travis Chase]

Mass Re-opening Bugs Frank Tang Closed on Wensday March 02 for no reason, all
the spam is his fault feel free to tar and feather him

Comment 5

[Travis Chase]

Reassigning Franks old bugs to Jungshik Shin for triage - Sorry for spam

Comment 6

[Henri Sivonen (:hsivonen)]

Bug 1261841 introduced a new API that does not have this design defect.