Closed Bug 506645 Opened 11 years ago Closed 11 years ago

nsTypedSelection::AddItem doesn't always null check aOutIndex

Categories

(Core :: DOM: Selection, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: timeless, Assigned: timeless)

References

(Blocks 1 open bug, )

Details

(Keywords: coverity, crash)

Attachments

(1 file)

3696 nsTypedSelection::AddItem(nsIRange *aItem, PRInt32 *aOutIndex)
3702   if (aOutIndex)
3703     *aOutIndex = -1;
3709     if (aOutIndex)
3710       *aOutIndex = 0;
3735     if (aOutIndex)
3736       *aOutIndex = startIndex;
3745 if (sameRange) {
3746 *aOutIndex = startIndex;
Attached patch patchSplinter Review
Assignee: nobody → timeless
Status: NEW → ASSIGNED
Attachment #390914 - Flags: review?(Olli.Pettay)
Attachment #390914 - Flags: review?(Olli.Pettay) → review+
http://hg.mozilla.org/mozilla-central/rev/887b14dbdf05
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.