HTMLEditor::ParseCFHTML validates the parsed CF_HTML offsets, but the EndFragment check tested startFragment < 0 instead of endFragment < 0 (a copy-paste error). A CF_HTML payload with a negative EndFragment offset was therefore accepted and used to Substring() out the fragment and context, extracting the wrong (oversized) region of the clipboard buffer instead of being rejected.

nsTSubstring::Substring clamps out-of-range start/length, so this is not an out-of-bounds read -- it is a correctness/robustness defect on malformed clipboard input, not a memory-safety bug.

Coverity CID 1639416.

The EndFragment block re-checked startFragment < 0, so a negative
endFragment from malformed CF_HTML passed validation and was later used
as a Substring offset/length.

https://hg.mozilla.org/mozilla-central/rev/efb2aafcd7aa