[Gnash-commit] gnash ChangeLog server/asobj/string.cpp

[Benjamin Wolsey]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Benjamin Wolsey <bwy>   08/03/28 11:23:28

Modified files:
        .              : ChangeLog 
        server/asobj   : string.cpp 

Log message:
        Fix out-of-bounds string access.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.6054&r2=1.6055
http://cvs.savannah.gnu.org/viewcvs/gnash/server/asobj/string.cpp?cvsroot=gnash&r1=1.61&r2=1.62

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.6054
retrieving revision 1.6055
diff -u -b -r1.6054 -r1.6055
--- ChangeLog   28 Mar 2008 10:32:27 -0000      1.6054
+++ ChangeLog   28 Mar 2008 11:23:27 -0000      1.6055
@@ -1,5 +1,11 @@
 2008-03-28 Benjamin Wolsey <address@hidden>
 
+       * server/asobj/string.cpp: (charCodeAt) don't try to
+         access string out of bounds. (Fixes abort in the movie
+         http://newsimg.bbc.co.uk/player/emp/2_0_1275/player.swf).
+
+2008-03-28 Benjamin Wolsey <address@hidden>
+
        * libbase/log.cpp: comment headers, minor alterations.
        * libbase/container.h: drop tu_config.h include.
 

Index: server/asobj/string.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/asobj/string.cpp,v
retrieving revision 1.61
retrieving revision 1.62
diff -u -b -r1.61 -r1.62
--- server/asobj/string.cpp     18 Mar 2008 14:01:00 -0000      1.61
+++ server/asobj/string.cpp     28 Mar 2008 11:23:27 -0000      1.62
@@ -588,9 +588,9 @@
         }
     )
 
-    size_t index = fn.arg(0).to_number<size_t>();
+    size_t index = static_cast<size_t>(fn.arg(0).to_number());
 
-    if (index > wstr.size()) {
+    if (index >= wstr.size()) {
         as_value rv;
         rv.set_nan();
         return rv;