9069 - nsStr::RFindCharInSet loops forever if destination not found

Status: VERIFIED FIXED

(Core :: XPCOM, defect, P3)

Description

[Heikki Toivonen (remove -bugzilla when emailing directly)]

The summary really says it all, but the reason is that we have an unsigned
integer that we are decrementing which means our loop will never terminate if a
searched character is not found.

PRInt32 nsStr::RFindCharInSet(const nsStr& aDest,const nsStr& aSet,PRBool
aIgnoreCase,PRUint32 anOffset) {
  PRUint32 offset=aDest.mLength-anOffset; // <= unsigned!
  PRInt32  thePos;

  while(--offset>=0) { // <= offset can never be < 0!
    PRUnichar theChar=GetCharAt(aDest,offset);

thePos=gRFindChars[aSet.mCharSize](aSet.mStr,aSet.mLength,0,theChar,aIgnoreCase)
;
    if(kNotFound!=thePos)
      return offset;
  } //while
  return kNotFound;
}


Also, the person fixing this bug should take a look at the usage of *int* and
*int32* in nsStr. My understanding is that we should use PRInt16/32!

Comment 1

[rickg]

This is fixed in my tree, and will land with my next update.

Comment 2

[rickg]

The fix has been checked in.

Comment 3

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Marking verified.

Comment 4

[Heikki Toivonen (remove -bugzilla when emailing directly)]

This is what vacation does to you: sloppiness. NOW it should be verified...