commit 58a5fb56c33a Author: Francois Marier Date: Thu Feb 15 12:30:40 2018 -0800 Bug 1435859 - Fix OOM crash on filenames without extensions. r=gcp, a=RyanVM Passing a value of -1 to nsCString::Truncate() converts that value to a large integer and leads to an unnecessary 4GB memory allocation. MozReview-Commit-ID: Icm5iUsEgA6 --HG-- extra : source : d418ce8a05644edb16f317c13fc1c8cd2b6c3c2f --- toolkit/components/url-classifier/Classifier.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git toolkit/components/url-classifier/Classifier.cpp toolkit/components/url-classifier/Classifier.cpp index 9946469268fa..d5ba67fe300a 100644 --- toolkit/components/url-classifier/Classifier.cpp +++ toolkit/components/url-classifier/Classifier.cpp @@ -359,8 +359,13 @@ Classifier::DeleteTables(nsIFile* aDirectory, const nsTArray& aTables rv = file->GetNativeLeafName(leafName); NS_ENSURE_SUCCESS_VOID(rv); - leafName.Truncate(leafName.RFind(".")); - if (aTables.Contains(leafName)) { + // Remove file extension if there's one. + int32_t dotPosition = leafName.RFind("."); + if (dotPosition >= 0) { + leafName.Truncate(dotPosition); + } + + if (!leafName.IsEmpty() && aTables.Contains(leafName)) { if (NS_FAILED(file->Remove(false))) { NS_WARNING(nsPrintfCString("Fail to remove file %s from the disk", leafName.get()).get());