diff options
| -rw-r--r-- | widget/windows/nsClipboard.cpp | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/widget/windows/nsClipboard.cpp b/widget/windows/nsClipboard.cpp index 0db1dd3424..432badeb57 100644 --- a/widget/windows/nsClipboard.cpp +++ b/widget/windows/nsClipboard.cpp @@ -283,16 +283,19 @@ nsresult nsClipboard::GetGlobalData(HGLOBAL aHGBL, void ** aData, uint32_t * aLe { // Allocate a new memory buffer and copy the data from global memory. // Recall that win98 allocates to nearest DWORD boundary. As a safety - // precaution, allocate an extra 2 bytes (but don't report them!) and - // null them out to ensure that all of our strlen calls will succeed. + // precaution, allocate an extra 3 bytes (but don't report them in |aLen|!) + // and null them out to ensure that all of our NS_strlen calls will succeed. + // NS_strlen operates on char16_t, so we need 3 NUL bytes to ensure it finds + // a full NUL char16_t when |*aLen| is odd. nsresult result = NS_ERROR_FAILURE; if (aHGBL != nullptr) { LPSTR lpStr = (LPSTR) GlobalLock(aHGBL); DWORD allocSize = GlobalSize(aHGBL); - char* data = static_cast<char*>(malloc(allocSize + sizeof(char16_t))); + char* data = static_cast<char*>(malloc(allocSize + 3)); if ( data ) { memcpy ( data, lpStr, allocSize ); - data[allocSize] = data[allocSize + 1] = '\0'; // null terminate for safety + data[allocSize] = data[allocSize + 1] = data[allocSize + 2] = + '\0'; // null terminate for safety GlobalUnlock(aHGBL); *aData = data; |