Index: patches/nss-appendava-invalid-read.patch |
=================================================================== |
--- patches/nss-appendava-invalid-read.patch (revision 0) |
+++ patches/nss-appendava-invalid-read.patch (revision 0) |
@@ -0,0 +1,16 @@ |
+Index: lib/certdb/alg1485.c |
+=================================================================== |
+--- lib/certdb/alg1485.c (revision 199075) |
++++ lib/certdb/alg1485.c (working copy) |
+@@ -1036,8 +1036,10 @@ |
+ } else { |
+ /* must truncate the escaped and quoted value */ |
+ char bigTmpBuf[TMPBUF_LEN * 3 + 3]; |
++ PORT_Assert(valueLen < sizeof tmpBuf); |
+ rv = escapeAndQuote(bigTmpBuf, sizeof bigTmpBuf, |
+- (char *)avaValue->data, valueLen, &mode); |
++ (char *)avaValue->data, |
++ PR_MIN(avaValue->len, valueLen), &mode); |
+ |
+ bigTmpBuf[valueLen--] = '\0'; /* hard stop here */ |
+ /* See if we're in the middle of a multi-byte UTF8 character */ |