Sylvestre Ledru 8a8de7c183 Bug 2051149 - Validate endFragment, not startFragment, in ParseCFHTML (Coverity CID 1639416) r=masayuki ...

The EndFragment block re-checked startFragment < 0, so a negative
endFragment from malformed CF_HTML passed validation and was later used
as a Substring offset/length.

Differential Revision: https://phabricator.services.mozilla.com/D309259

2026-06-29 06:41:52 +00:00

..

cfhtml-chromium.txt

…

cfhtml-firefox.txt

…

cfhtml-ie.txt

…

cfhtml-negative-endfragment.txt

…

cfhtml-nocontext.txt

…

cfhtml-ooo.txt

…