393630 - Potential crash on oom in GenerateAlternativeString

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Eli Friedman]

From bug 341500 comment 24:

(In reply to comment #23)
> (In reply to comment #20)
> > Created an attachment (id=247329) [edit] [details]
> > Replace the surrogate pair at disabling the shaping
> > Another approach, how about this?
> 
> | +        mAlternativeString = (PRUnichar *)malloc(mLength *
> sizeof(PRUnichar));
> | +        memcpy((void *)mAlternativeString, (const void *)mString,
> | +               mLength * sizeof(PRUnichar));
> 
> This can cause crash on OOM.
> 

Wow, you're right. I'll file and fix it.(after a business trip).

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Patch rv1.0

Sorry, I forgot this. Thank you for your report.

Comment 2

[Reed Loden [:reed]]

Checking in gfx/thebes/src/gfxWindowsFonts.cpp;
/cvsroot/mozilla/gfx/thebes/src/gfxWindowsFonts.cpp,v  <--  gfxWindowsFonts.cpp
new revision: 1.154; previous revision: 1.153
done

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Oops, thank you for your checking-in.