Commit 1df5568e authored by rswindell's avatar rswindell
Browse files

Fix likely cause of crash in MsgBase.get_msg_header(String id):

incrementing the argv index in a call to JSSTRING_TO_MSTRING causes the
index to be incremented twice!
parent 202b69cd
......@@ -1496,7 +1496,8 @@ js_get_msg_header(JSContext *cx, uintN argc, jsval *arglist)
smb_unlockmsghdr(&(p->p->smb),&(p->msg));
JS_RESUMEREQUEST(cx, rc);
} else if(JSVAL_IS_STRING(argv[n])) { /* Get by ID */
JSSTRING_TO_MSTRING(cx, JSVAL_TO_STRING(argv[n++]), cstr, NULL);
JSSTRING_TO_MSTRING(cx, JSVAL_TO_STRING(argv[n]), cstr, NULL);
n++;
HANDLE_PENDING(cx);
rc=JS_SUSPENDREQUEST(cx);
if((p->p->status=smb_getmsghdr_by_msgid(&(p->p->smb),&(p->msg)
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment