(same as firefox/minimo)

Fix a crash in prdtoa.c:mult() where there is an off-by-some bytes
in memory accessed during some very fucked up pointer acrobatics.
Allocate 2 bytes extra for that case, which seems to be a
sufficient hack to keep this working.

Debugged by me with minimo on zaurus/arm (pain!), seen also by krw@
and others on amd64, who helped with testing.  Due to random malloc
this of course did not show up everywhere all the time.
This commit is contained in:
pvalchev 2005-11-03 03:11:22 +00:00
parent 7e81f42e29
commit 46c63a4355
2 changed files with 15 additions and 3 deletions

View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile,v 1.94 2005/10/19 15:21:21 naddy Exp $
# $OpenBSD: Makefile,v 1.95 2005/11/03 03:11:22 pvalchev Exp $
ONLY_FOR_ARCHS= alpha i386 sparc sparc64 amd64 powerpc
@ -7,8 +7,8 @@ COMMENT-devel= "devel files for Gecko"
VER= 1.7.12
DISTNAME= mozilla
PKGNAME= mozilla-${VER}p3
PKGNAME-devel= mozilla-devel-${VER}p3
PKGNAME= mozilla-${VER}p4
PKGNAME-devel= mozilla-devel-${VER}p4
DISTFILES= mozilla-${VER}-source.tar.bz2
SO_VERSION= 5.0
# NOTE: Must bump minor version if any shlib's are removed from the

View File

@ -0,0 +1,12 @@
$OpenBSD: patch-nsprpub_pr_src_misc_prdtoa_c,v 1.1 2005/11/03 03:11:22 pvalchev Exp $
--- nsprpub/pr/src/misc/prdtoa.c.orig Thu Nov 3 04:06:59 2005
+++ nsprpub/pr/src/misc/prdtoa.c Thu Nov 3 04:07:12 2005
@@ -617,7 +617,7 @@ static Bigint *mult(CONST Bigint *a, CON
wc = wa + wb;
if (wc > a->maxwds)
k++;
- c = Balloc(k);
+ c = Balloc(k+2);
for(xc = c->x, xce = xc + wc; xc < xce; xc++)
*xc = 0;
xa = a->x;