Changeset 51833 in vbox

Timestamp:

Jul 3, 2014 7:20:56 AM (11 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

94681

Message:

xpcom18a4: upstream fix

File:

• trunk/src/libs/xpcom18a4/nsprpub/pr/src/io/prprf.c (modified) (4 diffs)

trunk/src/libs/xpcom18a4/nsprpub/pr/src/io/prprf.c

@@ -331 +331 @@
 ** form.
 **
-** XXX stop using sprintf to convert floating point
+** XXX stop using snprintf to convert floating point
 */
 static int cvt_f(SprintfState *ss, double d, const char *fmt0, const char *fmt1)
@@ -339 +339 @@
     int amount = fmt1 - fmt0;
 
-    PR_ASSERT((amount > 0) && (amount < sizeof(fin)));
-    if (amount >= sizeof(fin)) {
-        /* Totally bogus % command to sprintf. Just ignore it */
+    if (amount <= 0 || amount >= sizeof(fin)) {
+        /* Totally bogus % command to snprintf. Just ignore it */
         return 0;
     }
@@ -347 +346 @@
     fin[amount] = 0;
 
-    /* Convert floating point using the native sprintf code */
+    /* Convert floating point using the native snprintf code */
 #ifdef DEBUG
     {
@@ -357 +356 @@
     }
 #endif
-    sprintf(fout, fin, d);
-
-    /*
-    ** This assert will catch overflow's of fout, when building with
-    ** debugging on. At least this way we can track down the evil piece
-    ** of calling code and fix it!
-    */
-    PR_ASSERT(strlen(fout) < sizeof(fout));
+    memset(fout, 0, sizeof(fout));
+    snprintf(fout, sizeof(fout), fin, d);
+    /* Explicitly null-terminate fout because on Windows snprintf doesn't
+     * append a null-terminator if the buffer is too small. */
+    fout[sizeof(fout) - 1] = '\0';
 
     return (*ss->stuff)(ss, fout, strlen(fout));