Bug 1248551 - memset levState at the begining of ResolveImplicitLevels and avoid assigning -1 to levState.startON that could cause a bad access. r?roc draft
authorBogdan Postelnicu <bogdan.postelnicu@softvision.ro>
Tue, 16 Feb 2016 12:45:17 +0200
changeset 331184 11109f3d5c8bef1497cfd3ed40a28329c655acef
parent 330984 ea39d4a6232c278dd8d805608a07cf9f4cc4c76b
child 514325 a6698d4ffb52836b3e41bde3a7dd36829257a1ff
push id10925
push userBogdan.Postelnicu@softvision.ro
push dateTue, 16 Feb 2016 10:46:31 +0000
reviewersroc
bugs1248551
milestone47.0a1
Bug 1248551 - memset levState at the begining of ResolveImplicitLevels and avoid assigning -1 to levState.startON that could cause a bad access. r?roc MozReview-Commit-ID: 5BOwIu721Oe
layout/base/nsBidi.cpp
--- a/layout/base/nsBidi.cpp
+++ b/layout/base/nsBidi.cpp
@@ -1479,32 +1479,33 @@ void nsBidi::ResolveImplicitLevels(int32
 {
   const DirProp *dirProps = mDirProps;
   DirProp dirProp;
   LevState levState;
   int32_t i, start1, start2;
   uint16_t oldStateImp, stateImp, actionImp;
   uint8_t gprop, resProp, cell;
 
+  memset(&levState, 0, sizeof(LevState));
   /* initialize for property and levels state tables */
   levState.runStart = aStart;
   levState.runLevel = mLevels[aStart];
   levState.pImpTab = impTab[levState.runLevel & 1];
   levState.pImpAct = impAct0;
 
   /* The isolates[] entries contain enough information to
      resume the bidi algorithm in the same state as it was
      when it was interrupted by an isolate sequence. */
   if (dirProps[aStart] == PDI && mIsolateCount >= 0) {
     start1 = mIsolates[mIsolateCount].start1;
     stateImp = mIsolates[mIsolateCount].stateImp;
     levState.state = mIsolates[mIsolateCount].state;
     mIsolateCount--;
   } else {
-    levState.startON = -1;
+    levState.startON = 0;
     start1 = aStart;
     if (dirProps[aStart] == NSM) {
       stateImp = 1 + aSOR;
     } else {
       stateImp = 0;
     }
     levState.state = 0;
     ProcessPropertySeq(&levState, aSOR, aStart, aStart);