265829 - history code passes incorrect length to NS_ConvertUTF16toUTF8

Status: RESOLVED FIXED

(Firefox :: Bookmarks & History, defect)

Description

[Brian Ryner (not reading)]

In nsGlobalHistory::RowMatches(), NS_ConvertUTF16toUTF8 is called with
|yarnLength| passed as the length.  However, this is the string length in bytes,
while the string code wants the length in characters.

Comment 1

[Brian Ryner (not reading)]

Attachment: patch

This can and does result in reading uninitialized memory...

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 163191 [details] [diff] [review]
patch

r=[e-mail]

Comment 3

[Brian Ryner (not reading)]

Comment on attachment 163191 [details] [diff] [review]
patch

Can we get this in on the branch? It's likely causing random odd behavior or
crashes when people use history autocomplete.

Comment 4

[Asa Dotzler [:asa]]

Comment on attachment 163191 [details] [diff] [review]
patch

a=asa for aviary checkin.

Comment 5

[Brian Ryner (not reading)]

checked into trunk and branch