⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 157341 in webkit


Ignore:
Timestamp:
Oct 12, 2013, 11:03:39 AM (13 years ago)
Author:
akling@apple.com
Message:

Replace bounds checking ASSERTs with ASSERT_WITH_SECURITY_IMPLICATION
​https://bugs.webkit.org/show_bug.cgi?id=120893

Patch by Jessica Pease <​jessica_n_pease@apple.com> on 2013-09-06
Reviewed by Darin Adler.

Source/WebCore:

  • Modules/indexeddb/IDBKeyPath.cpp:

(WebCore::IDBKeyPathLexer::lex):

  • Modules/indexeddb/IDBLevelDBCoding.cpp:

(WebCore::IDBLevelDBCoding::compareEncodedIDBKeys):

  • bindings/js/JSCSSStyleDeclarationCustom.cpp:

(WebCore::cssPropertyIDForJSCSSPropertyName):

  • css/CSSFontSelector.cpp:

(WebCore::compareFontFaces):

  • css/CSSParser.cpp:

(WebCore::CSSParser::rewriteSpecifiers):

  • html/HTMLCollection.cpp:

(WebCore::traverseMatchingElementsForwardToOffset):
(WebCore::LiveNodeListBase::traverseChildNodeListForwardToOffset):
(WebCore::HTMLCollection::traverseForwardToOffset):

  • html/HTMLFontElement.cpp:

(WebCore::parseFontSize):

  • html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLIntegerInternal):
(WebCore::parseHTMLNonNegativeIntegerInternal):

  • inspector/InspectorStyleSheet.h:

(WebCore::InspectorStyleProperty::setRawTextFromStyleDeclaration):

  • platform/graphics/StringTruncator.cpp:

(WebCore::centerTruncateToBuffer):
(WebCore::rightTruncateToBuffer):
(WebCore::truncateString):

  • platform/graphics/TextRun.h:

(WebCore::TextRun::subRun):

  • platform/text/BidiRunList.h:

(WebCore::::reverseRuns):

  • rendering/svg/SVGInlineTextBox.cpp:

(WebCore::SVGInlineTextBox::selectionRectForTextFragment):
(WebCore::SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates):

  • rendering/svg/SVGTextChunkBuilder.cpp:

(WebCore::SVGTextChunkBuilder::buildTextChunks):

  • rendering/svg/SVGTextLayoutEngine.cpp:

(WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics):

  • rendering/svg/SVGTextQuery.cpp:

(WebCore::SVGTextQuery::mapStartEndPositionsIntoFragmentCoordinates):

  • svg/SVGAnimationElement.cpp:

(WebCore::SVGAnimationElement::currentValuesForValuesAnimation):

  • svg/SVGPathByteStreamSource.h:

(WebCore::SVGPathByteStreamSource::readType):

Source/WebKit2:

  • Shared/Plugins/PluginQuirks.h:

(WebKit::PluginQuirks::add):

Source/WTF:

  • wtf/BumpPointerAllocator.h:

(WTF::BumpPointerPool::ensureCapacity):
(WTF::BumpPointerPool::alloc):
(WTF::BumpPointerPool::ensureCapacityCrossPool):

  • wtf/FastMalloc.cpp:

(WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):

  • wtf/StringPrintStream.cpp:

(WTF::StringPrintStream::increaseSize):

  • wtf/dtoa/utils.h:

(WTF::double_conversion::BufferReference::SubBufferReference):

  • wtf/text/WTFString.cpp:

(WTF::String::fromUTF8):

Location:
trunk/Source
Files:
27 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WTF/ChangeLog

    r157330 r157341  
     12013-09-06  Jessica Pease  <jessica_n_pease@apple.com>
     2
     3        Replace bounds checking ASSERTs with ASSERT_WITH_SECURITY_IMPLICATION
     4        https://bugs.webkit.org/show_bug.cgi?id=120893
     5
     6        Reviewed by Darin Adler.
     7
     8        * wtf/BumpPointerAllocator.h:
     9        (WTF::BumpPointerPool::ensureCapacity):
     10        (WTF::BumpPointerPool::alloc):
     11        (WTF::BumpPointerPool::ensureCapacityCrossPool):
     12        * wtf/FastMalloc.cpp:
     13        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
     14        * wtf/StringPrintStream.cpp:
     15        (WTF::StringPrintStream::increaseSize):
     16        * wtf/dtoa/utils.h:
     17        (WTF::double_conversion::BufferReference::SubBufferReference):
     18        * wtf/text/WTFString.cpp:
     19        (WTF::String::fromUTF8):
     20
    1212013-10-11  Darin Adler  <darin@apple.com>
    222

  • trunk/Source/WTF/wtf/BumpPointerAllocator.h

    r114477 r157341  
    4848    {
    4949        void* allocationEnd = static_cast<char*>(m_current) + size;
    50         ASSERT(allocationEnd > m_current); // check for overflow
     50        ASSERT_WITH_SECURITY_IMPLICATION(allocationEnd > m_current); // check for overflow
    5151        if (allocationEnd <= static_cast<void*>(this))
    5252            return this;
    … …  
    6060        void* current = m_current;
    6161        void* allocationEnd = static_cast<char*>(current) + size;
    62         ASSERT(allocationEnd > current); // check for overflow
     62        ASSERT_WITH_SECURITY_IMPLICATION(allocationEnd > current); // check for overflow
    6363        ASSERT(allocationEnd <= static_cast<void*>(this));
    6464        m_current = allocationEnd;
    … …  
    164164            void* current = pool->m_current;
    165165            void* allocationEnd = static_cast<char*>(current) + size;
    166             ASSERT(allocationEnd > current); // check for overflow
     166            ASSERT_WITH_SECURITY_IMPLICATION(allocationEnd > current); // check for overflow
    167167            if (allocationEnd <= static_cast<void*>(pool))
    168168                return pool;

  • trunk/Source/WTF/wtf/FastMalloc.cpp

    r156775 r157341  
    38003800  int used_slots = 0;
    38013801  for (Span* s = sampled_objects.next; s != &sampled_objects; s = s->next) {
    3802     ASSERT(used_slots < needed_slots); // Need to leave room for terminator
     3802    ASSERT_WITH_SECURITY_IMPLICATION(used_slots < needed_slots); // Need to leave room for terminator
    38033803    StackTrace* stack = reinterpret_cast<StackTrace*>(s->objects);
    38043804    if (used_slots + 3 + stack->depth >= needed_slots) {
    … …  
    41644164    skip++;
    41654165  }
    4166   ASSERT(skip < alloc);
     4166  ASSERT_WITH_SECURITY_IMPLICATION(skip < alloc);
    41674167  if (skip > 0) {
    41684168    Span* rest = pageheap->Split(span, skip);

  • trunk/Source/WTF/wtf/StringPrintStream.cpp

    r142434 r157341  
    107107void StringPrintStream::increaseSize(size_t newSize)
    108108{
    109     ASSERT(newSize > m_size);
     109    ASSERT_WITH_SECURITY_IMPLICATION(newSize > m_size);
    110110    ASSERT(newSize > sizeof(m_inlineBuffer));
    111111   

  • trunk/Source/WTF/wtf/dtoa/utils.h

    r155958 r157341  
    154154        BufferReference<T> SubBufferReference(int from, int to) {
    155155            ASSERT(to <= length_);
    156             ASSERT(from < to);
     156            ASSERT_WITH_SECURITY_IMPLICATION(from < to);
    157157            ASSERT(0 <= from);
    158158            return BufferReference<T>(start() + from, to - from);

  • trunk/Source/WTF/wtf/text/WTFString.cpp

    r156948 r157341  
    850850
    851851    unsigned utf16Length = bufferCurrent - bufferStart;
    852     ASSERT(utf16Length < length);
     852    ASSERT_WITH_SECURITY_IMPLICATION(utf16Length < length);
    853853    return StringImpl::create(bufferStart, utf16Length);
    854854}

  • trunk/Source/WebCore/ChangeLog

    r157340 r157341  
     12013-09-06  Jessica Pease  <jessica_n_pease@apple.com>
     2
     3        Replace bounds checking ASSERTs with ASSERT_WITH_SECURITY_IMPLICATION
     4        https://bugs.webkit.org/show_bug.cgi?id=120893
     5
     6        Reviewed by Darin Adler.
     7
     8        * Modules/indexeddb/IDBKeyPath.cpp:
     9        (WebCore::IDBKeyPathLexer::lex):
     10        * Modules/indexeddb/IDBLevelDBCoding.cpp:
     11        (WebCore::IDBLevelDBCoding::compareEncodedIDBKeys):
     12        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
     13        (WebCore::cssPropertyIDForJSCSSPropertyName):
     14        * css/CSSFontSelector.cpp:
     15        (WebCore::compareFontFaces):
     16        * css/CSSParser.cpp:
     17        (WebCore::CSSParser::rewriteSpecifiers):
     18        * html/HTMLCollection.cpp:
     19        (WebCore::traverseMatchingElementsForwardToOffset):
     20        (WebCore::LiveNodeListBase::traverseChildNodeListForwardToOffset):
     21        (WebCore::HTMLCollection::traverseForwardToOffset):
     22        * html/HTMLFontElement.cpp:
     23        (WebCore::parseFontSize):
     24        * html/parser/HTMLParserIdioms.cpp:
     25        (WebCore::parseHTMLIntegerInternal):
     26        (WebCore::parseHTMLNonNegativeIntegerInternal):
     27        * inspector/InspectorStyleSheet.h:
     28        (WebCore::InspectorStyleProperty::setRawTextFromStyleDeclaration):
     29        * platform/graphics/StringTruncator.cpp:
     30        (WebCore::centerTruncateToBuffer):
     31        (WebCore::rightTruncateToBuffer):
     32        (WebCore::truncateString):
     33        * platform/graphics/TextRun.h:
     34        (WebCore::TextRun::subRun):
     35        * platform/text/BidiRunList.h:
     36        (WebCore::::reverseRuns):
     37        * rendering/svg/SVGInlineTextBox.cpp:
     38        (WebCore::SVGInlineTextBox::selectionRectForTextFragment):
     39        (WebCore::SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates):
     40        * rendering/svg/SVGTextChunkBuilder.cpp:
     41        (WebCore::SVGTextChunkBuilder::buildTextChunks):
     42        * rendering/svg/SVGTextLayoutEngine.cpp:
     43        (WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics):
     44        * rendering/svg/SVGTextQuery.cpp:
     45        (WebCore::SVGTextQuery::mapStartEndPositionsIntoFragmentCoordinates):
     46        * svg/SVGAnimationElement.cpp:
     47        (WebCore::SVGAnimationElement::currentValuesForValuesAnimation):
     48        * svg/SVGPathByteStreamSource.h:
     49        (WebCore::SVGPathByteStreamSource::readType):
     50
    1512013-10-12  Antti Koivisto  <antti@apple.com>
    252

  • trunk/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp

    r157330 r157341  
    7676    if (m_ptr >= m_end)
    7777        return TokenEnd;
    78     ASSERT(m_ptr < m_end);
     78    ASSERT_WITH_SECURITY_IMPLICATION(m_ptr < m_end);
    7979
    8080    if (*m_ptr == '.') {

  • trunk/Source/WebCore/Modules/indexeddb/leveldb/IDBLevelDBCoding.cpp

    r156590 r157341  
    585585    ok = true;
    586586    ASSERT(&ptrA != &ptrB);
    587     ASSERT(ptrA < limitA);
    588     ASSERT(ptrB < limitB);
     587    ASSERT_WITH_SECURITY_IMPLICATION(ptrA < limitA);
     588    ASSERT_WITH_SECURITY_IMPLICATION(ptrB < limitB);
    589589    unsigned char typeA = *ptrA++;
    590590    unsigned char typeB = *ptrB++;

  • trunk/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp

    r157215 r157341  
    261261        } else
    262262            *bufferPtr++ = c;
    263         ASSERT(bufferPtr < bufferEnd);
    264     }
    265     ASSERT(bufferPtr < bufferEnd);
     263        ASSERT_WITH_SECURITY_IMPLICATION(bufferPtr < bufferEnd);
     264    }
     265    ASSERT_WITH_SECURITY_IMPLICATION(bufferPtr < bufferEnd);
    266266    *bufferPtr = '\0';
    267267

  • trunk/Source/WebCore/css/CSSFontSelector.cpp

    r157265 r157341  
    467467    }
    468468
    469     ASSERT(ruleSetIndex < fallbackRuleSets);
     469    ASSERT_WITH_SECURITY_IMPLICATION(ruleSetIndex < fallbackRuleSets);
    470470    const FontTraitsMask* weightFallbackRule = weightFallbackRuleSets[ruleSetIndex];
    471471    for (unsigned i = 0; i < rulesPerSet; ++i) {

  • trunk/Source/WebCore/css/CSSParser.cpp

    r157330 r157341  
    1216512165        const unsigned start = m_propertyRange.start;
    1216612166        const unsigned end = m_propertyRange.end;
    12167         ASSERT(start < end);
     12167        ASSERT_WITH_SECURITY_IMPLICATION(start < end);
    1216812168        String propertyString;
    1216912169        if (is8BitSource())

  • trunk/Source/WebCore/html/HTMLCollection.cpp

    r157065 r157341  
    325325inline Element* traverseMatchingElementsForwardToOffset(const NodeListType* nodeList, unsigned offset, Element* currentElement, unsigned& currentOffset, ContainerNode* root)
    326326{
    327     ASSERT(currentOffset < offset);
     327    ASSERT_WITH_SECURITY_IMPLICATION(currentOffset < offset);
    328328    while ((currentElement = nextMatchingElement(nodeList, currentElement, root))) {
    329329        if (++currentOffset == offset)
    … …  
    337337{
    338338    ASSERT(type() == ChildNodeListType);
    339     ASSERT(currentOffset < offset);
     339    ASSERT_WITH_SECURITY_IMPLICATION(currentOffset < offset);
    340340    while ((currentNode = currentNode->nextSibling())) {
    341341        if (++currentOffset == offset)
    … …  
    549549inline Element* HTMLCollection::traverseForwardToOffset(unsigned offset, Element* currentElement, unsigned& currentOffset, unsigned& offsetInArray, ContainerNode* root) const
    550550{
    551     ASSERT(currentOffset < offset);
     551    ASSERT_WITH_SECURITY_IMPLICATION(currentOffset < offset);
    552552    if (overridesItemAfter()) {
    553553        offsetInArray = m_cachedElementsArrayOffset;

  • trunk/Source/WebCore/html/HTMLFontElement.cpp

    r155795 r157341  
    7272    if (position == end)
    7373        return false;
    74     ASSERT(position < end);
     74    ASSERT_WITH_SECURITY_IMPLICATION(position < end);
    7575
    7676    // Step 5

  • trunk/Source/WebCore/html/parser/HTMLParserIdioms.cpp

    r156902 r157341  
    170170    if (position == end)
    171171        return false;
    172     ASSERT(position < end);
     172    ASSERT_WITH_SECURITY_IMPLICATION(position < end);
    173173
    174174    // Step 6
    … …  
    180180    if (position == end)
    181181        return false;
    182     ASSERT(position < end);
     182    ASSERT_WITH_SECURITY_IMPLICATION(position < end);
    183183
    184184    // Step 7
    … …  
    231231    if (position == end)
    232232        return false;
    233     ASSERT(position < end);
     233    ASSERT_WITH_SECURITY_IMPLICATION(position < end);
    234234
    235235    // Step 5
    … …  
    240240    if (position == end)
    241241        return false;
    242     ASSERT(position < end);
     242    ASSERT_WITH_SECURITY_IMPLICATION(position < end);
    243243
    244244    // Step 7

  • trunk/Source/WebCore/inspector/InspectorStyleSheet.h

    r155886 r157341  
    122122        unsigned start = sourceData.range.start;
    123123        unsigned end = sourceData.range.end;
    124         ASSERT(start < end);
     124        ASSERT_WITH_SECURITY_IMPLICATION(start < end);
    125125        ASSERT(end <= styleDeclaration.length());
    126126        rawText = styleDeclaration.substring(start, end - start);

  • trunk/Source/WebCore/platform/graphics/StringTruncator.cpp

    r118568 r157341  
    6060static unsigned centerTruncateToBuffer(const String& string, unsigned length, unsigned keepCount, UChar* buffer)
    6161{
    62     ASSERT(keepCount < length);
    63     ASSERT(keepCount < STRING_BUFFER_SIZE);
     62    ASSERT_WITH_SECURITY_IMPLICATION(keepCount < length);
     63    ASSERT_WITH_SECURITY_IMPLICATION(keepCount < STRING_BUFFER_SIZE);
    6464   
    6565    unsigned omitStart = (keepCount + 1) / 2;
    … …  
    8080static unsigned rightTruncateToBuffer(const String& string, unsigned length, unsigned keepCount, UChar* buffer)
    8181{
    82     ASSERT(keepCount < length);
    83     ASSERT(keepCount < STRING_BUFFER_SIZE);
     82    ASSERT_WITH_SECURITY_IMPLICATION(keepCount < length);
     83    ASSERT_WITH_SECURITY_IMPLICATION(keepCount < STRING_BUFFER_SIZE);
    8484   
    8585    NonSharedCharacterBreakIterator it(string.characters(), length);
    … …  
    140140   
    141141    while (keepCountForLargestKnownToFit + 1 < keepCountForSmallestKnownToNotFit) {
    142         ASSERT(widthForLargestKnownToFit <= maxWidth);
    143         ASSERT(widthForSmallestKnownToNotFit > maxWidth);
     142        ASSERT_WITH_SECURITY_IMPLICATION(widthForLargestKnownToFit <= maxWidth);
     143        ASSERT_WITH_SECURITY_IMPLICATION(widthForSmallestKnownToNotFit > maxWidth);
    144144
    145145        float ratio = (keepCountForSmallestKnownToNotFit - keepCountForLargestKnownToFit)
    … …  
    153153        }
    154154       
    155         ASSERT(keepCount < length);
     155        ASSERT_WITH_SECURITY_IMPLICATION(keepCount < length);
    156156        ASSERT(keepCount > 0);
    157         ASSERT(keepCount < keepCountForSmallestKnownToNotFit);
    158         ASSERT(keepCount > keepCountForLargestKnownToFit);
     157        ASSERT_WITH_SECURITY_IMPLICATION(keepCount < keepCountForSmallestKnownToNotFit);
     158        ASSERT_WITH_SECURITY_IMPLICATION(keepCount > keepCountForLargestKnownToFit);
    159159       
    160160        truncatedLength = truncateToBuffer(string, length, keepCount, stringBuffer);

  • trunk/Source/WebCore/platform/graphics/TextRun.h

    r156393 r157341  
    140140    TextRun subRun(unsigned startOffset, unsigned length) const
    141141    {
    142         ASSERT(startOffset < m_len);
     142        ASSERT_WITH_SECURITY_IMPLICATION(startOffset < m_len);
    143143
    144144        TextRun result = *this;

  • trunk/Source/WebCore/platform/text/BidiRunList.h

    r95901 r157341  
    205205        return;
    206206
    207     ASSERT(end < m_runCount);
     207    ASSERT_WITH_SECURITY_IMPLICATION(end < m_runCount);
    208208
    209209    // Get the item before the start of the runs to reverse and put it in

  • trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp

    r157011 r157341  
    109109FloatRect SVGInlineTextBox::selectionRectForTextFragment(const SVGTextFragment& fragment, int startPosition, int endPosition, RenderStyle* style)
    110110{
    111     ASSERT(startPosition < endPosition);
     111    ASSERT_WITH_SECURITY_IMPLICATION(startPosition < endPosition);
    112112    ASSERT(style);
    113113
    … …  
    455455    }
    456456
    457     ASSERT(startPosition < endPosition);
     457    ASSERT_WITH_SECURITY_IMPLICATION(startPosition < endPosition);
    458458    return true;
    459459}

  • trunk/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp

    r156094 r157341  
    6363            foundStart = true;
    6464        } else {
    65             ASSERT(boxPosition > lastChunkStartPosition);
     65            ASSERT_WITH_SECURITY_IMPLICATION(boxPosition > lastChunkStartPosition);
    6666            addTextChunk(lineLayoutBoxes, lastChunkStartPosition, boxPosition - lastChunkStartPosition);
    6767            lastChunkStartPosition = boxPosition;

  • trunk/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp

    r156151 r157341  
    368368
    369369        ASSERT(textMetricsSize);
    370         ASSERT(m_logicalMetricsListOffset < textMetricsSize);
     370        ASSERT_WITH_SECURITY_IMPLICATION(m_logicalMetricsListOffset < textMetricsSize);
    371371        logicalMetrics = textMetricsValues->at(m_logicalMetricsListOffset);
    372372        if (logicalMetrics.isEmpty() || (!logicalMetrics.width() && !logicalMetrics.height())) {

  • trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp

    r156094 r157341  
    152152        return false;
    153153
    154     ASSERT(startPosition < endPosition);
     154    ASSERT_WITH_SECURITY_IMPLICATION(startPosition < endPosition);
    155155    return true;
    156156}

  • trunk/Source/WebCore/svg/SVGAnimationElement.cpp

    r155815 r157341  
    538538    from = m_values[index];
    539539    to = m_values[index + 1];
    540     ASSERT(toPercent > fromPercent);
     540    ASSERT_WITH_SECURITY_IMPLICATION(toPercent > fromPercent);
    541541    effectivePercent = (percent - fromPercent) / (toPercent - fromPercent);
    542542

  • trunk/Source/WebCore/svg/SVGPathByteStreamSource.h

    r120044 r157341  
    6464
    6565        for (size_t i = 0; i < typeSize; ++i) {
    66             ASSERT(m_streamCurrent < m_streamEnd);
     66            ASSERT_WITH_SECURITY_IMPLICATION(m_streamCurrent < m_streamEnd);
    6767            data.bytes[i] = *m_streamCurrent;
    6868            ++m_streamCurrent;

  • trunk/Source/WebKit2/ChangeLog

    r157337 r157341  
     12013-09-06  Jessica Pease  <jessica_n_pease@apple.com>
     2
     3        Replace bounds checking ASSERTs with ASSERT_WITH_SECURITY_IMPLICATION
     4        https://bugs.webkit.org/show_bug.cgi?id=120893
     5
     6        Reviewed by Darin Adler.
     7
     8        * Shared/Plugins/PluginQuirks.h:
     9        (WebKit::PluginQuirks::add):
     10
    1112013-10-12  Darin Adler  <darin@apple.com>
    212

  • trunk/Source/WebKit2/Shared/Plugins/PluginQuirks.h

    r142314 r157341  
    114114    {
    115115        ASSERT(quirk >= 0);
    116         ASSERT(quirk < NumPluginQuirks);
     116        ASSERT_WITH_SECURITY_IMPLICATION(quirk < NumPluginQuirks);
    117117       
    118118        m_quirks |= (1 << quirk);
Note: See TracChangeset for help on using the changeset viewer.