1 files changed, 84 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-7199.patch b/gnu/packages/patches/icecat-CVE-2015-7199.patch
new file mode 100644
index 0000000000..d6b830b8a0
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7199.patch
@@ -0,0 +1,84 @@
+From 04741232fa561a4c299f31a5b5fb4603da79d2c5 Mon Sep 17 00:00:00 2001
+From: Robert Longson <longsonr@gmail.com>
+Date: Tue, 6 Oct 2015 13:19:03 +0100
+Subject: [PATCH] Bug 1204061 - check return values from some methods
+ r=dholbert, a=sylvestre
+
+--HG--
+extra : source : f4c2f277aeae7bf8b05c6b01d1e140cd51b693b4
+---
+ dom/svg/SVGPathSegListSMILType.cpp | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/dom/svg/SVGPathSegListSMILType.cpp b/dom/svg/SVGPathSegListSMILType.cpp
+index f8b67d0..6df0f53 100644
+--- a/dom/svg/SVGPathSegListSMILType.cpp
++++ b/dom/svg/SVGPathSegListSMILType.cpp
+@@ -232,7 +232,7 @@ AddWeightedPathSegs(double aCoeff1,
+  *                         identity, in which case we'll grow it to the right
+  *                         size. Also allowed to be the same list as aList1.
+  */
+-static void
++static nsresult
+ AddWeightedPathSegLists(double aCoeff1, const SVGPathDataAndInfo& aList1,
+                         double aCoeff2, const SVGPathDataAndInfo& aList2,
+                         SVGPathDataAndInfo& aResult)
+@@ -263,8 +263,9 @@ AddWeightedPathSegLists(double aCoeff1, const SVGPathDataAndInfo& aList1,
+   // because in that case, we will have already set iter1 to nullptr above, to
+   // record that our first operand is an identity value.)
+   if (aResult.IsIdentity()) {
+-    DebugOnly<bool> success = aResult.SetLength(aList2.Length());
+-    MOZ_ASSERT(success, "infallible nsTArray::SetLength should succeed");
++    if (!aResult.SetLength(aList2.Length())) {
++      return NS_ERROR_OUT_OF_MEMORY;
++    }
+     aResult.SetElement(aList2.Element()); // propagate target element info!
+   }
+ 
+@@ -280,6 +281,7 @@ AddWeightedPathSegLists(double aCoeff1, const SVGPathDataAndInfo& aList1,
+              iter2 == end2 &&
+              resultIter == aResult.end(),
+              "Very, very bad - path data corrupt");
++  return NS_OK;
+ }
+ 
+ static void
+@@ -429,9 +431,7 @@ SVGPathSegListSMILType::Add(nsSMILValue& aDest,
+     }
+   }
+ 
+-  AddWeightedPathSegLists(1.0, dest, aCount, valueToAdd, dest);
+-
+-  return NS_OK;
++  return AddWeightedPathSegLists(1.0, dest, aCount, valueToAdd, dest);
+ }
+ 
+ nsresult
+@@ -482,8 +482,9 @@ SVGPathSegListSMILType::Interpolate(const nsSMILValue& aStartVal,
+   if (check == eRequiresConversion) {
+     // Can't convert |start| in-place, since it's const. Instead, we copy it
+     // into |result|, converting the types as we go, and use that as our start.
+-    DebugOnly<bool> success = result.SetLength(end.Length());
+-    MOZ_ASSERT(success, "infallible nsTArray::SetLength should succeed");
++    if (!result.SetLength(end.Length())) {
++      return NS_ERROR_OUT_OF_MEMORY;
++    }
+     result.SetElement(end.Element()); // propagate target element info!
+ 
+     ConvertAllPathSegmentData(start.begin(), start.end(),
+@@ -492,10 +493,8 @@ SVGPathSegListSMILType::Interpolate(const nsSMILValue& aStartVal,
+     startListToUse = &result;
+   }
+ 
+-  AddWeightedPathSegLists(1.0 - aUnitDistance, *startListToUse,
+-                          aUnitDistance, end, result);
+-
+-  return NS_OK;
++  return AddWeightedPathSegLists(1.0 - aUnitDistance, *startListToUse,
++                                 aUnitDistance, end, result);
+ }
+ 
+ } // namespace mozilla
+-- 
+2.5.0
+