bug 280387: Fix a potential crash by passing PR_TRUE for the aReverse paramter to nsScanner::SetPosition(). r+sr=bzbarsky

2005-01-31 00:54:53 +00:00
parent 12fef8a78f
commit eb81d6529c
1 changed files with 6 additions and 1 deletions
@@ -879,7 +879,12 @@ nsresult CTextToken::ConsumeParsedCharacterData(PRUnichar aChar,
                              *end == '\r' || *end == '\b')) {
          aFound = PR_TRUE;
          mTextValue.Rebind(theContent.str());
-          aScanner.SetPosition(currPos);
+
+          // Note: This SetPosition() is actually going backwards from the
+          // scanner's mCurrentPosition (so we pass aReverse == PR_TRUE). This
+          // is because we call GetChar() above after we get the current
+          // position.
+          aScanner.SetPosition(currPos, PR_FALSE, PR_TRUE);
          break;
        }
      }