Fix the invalid read (heap-buffer-overflow) error in AppendAVA().

nss/lib/certdb/alg1485.c

 /* alg1485.c - implementation of RFCs 1485, 1779 and 2253.
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "prprf.h"
 #include "cert.h"
 #include "certi.h"
 #include "xconst.h"
@@ skipping 1018 matching lines @@
             end[-2] = '.';
             end[-3] = '.';
         }
         rv = SECSuccess;
     } else if (!truncateValue) {
         rv = escapeAndQuote(encodedAVA + nameLen, len - nameLen, 
                             (char *)avaValue->data, avaValue->len, &mode);
     } else {
         /* must truncate the escaped and quoted value */
         char bigTmpBuf[TMPBUF_LEN * 3 + 3];
+        PORT_Assert(valueLen < sizeof tmpBuf);
         rv = escapeAndQuote(bigTmpBuf, sizeof bigTmpBuf,
-                            (char *)avaValue->data, valueLen, &mode);
+                            (char *)avaValue->data,
+                            PR_MIN(avaValue->len, valueLen), &mode);
 
         bigTmpBuf[valueLen--] = '\0'; /* hard stop here */
         /* See if we're in the middle of a multi-byte UTF8 character */
         while (((bigTmpBuf[valueLen] & 0xc0) == 0x80) && valueLen > 0) {
             bigTmpBuf[valueLen--] = '\0';
         }
         /* add ellipsis to signify truncation. */
         bigTmpBuf[++valueLen] = '.';
         bigTmpBuf[++valueLen] = '.';
         bigTmpBuf[++valueLen] = '.';
@@ skipping 498 matching lines @@
 {
     return(CERT_GetNameElement(NULL, name, SEC_OID_AVA_DN_QUALIFIER));
 }
 
 char *
 CERT_GetCertUid(const CERTName *name)
 {
     return(CERT_GetNameElement(NULL, name, SEC_OID_RFC1274_UID));
 }