Changeset 230605 in webkit
- Timestamp:
- Apr 12, 2018 4:21:46 PM (6 years ago)
- Location:
- branches/safari-605.1.33.0-branch
- Files:
-
- 1 added
- 5 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/safari-605.1.33.0-branch/JSTests/ChangeLog
r228910 r230605 1 2018-04-12 Kocsen Chung <kocsen_chung@apple.com> 2 3 Cherry-pick r230101. rdar://problem/39355291 4 5 Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType 6 https://bugs.webkit.org/show_bug.cgi?id=183657 7 JSTests: 8 9 Reviewed by Keith Miller. 10 11 * stress/large-unshift-splice.js: Added. 12 (make_contig_arr): 13 14 Source/JavaScriptCore: 15 16 <rdar://problem/38464399> 17 18 Reviewed by Keith Miller. 19 20 There was just a missing check in unshiftCountForIndexingType. 21 I've also replaced 'return false' by 'return true' in the case of an 'out-of-memory' exception, because 'return false' means 'please continue to the slow path', 22 and the slow path has an assert that there is no unhandled exception (line 360 of ArrayPrototype.cpp). 23 Finally, I made the assert in ensureLength a release assert as it would have caught this bug and prevented it from being a security risk. 24 25 * runtime/ArrayPrototype.cpp: 26 (JSC::unshift): 27 * runtime/JSArray.cpp: 28 (JSC::JSArray::unshiftCountWithAnyIndexingType): 29 * runtime/JSObject.h: 30 (JSC::JSObject::ensureLength): 31 32 git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230101 268f45cc-cd09-0410-ab3c-d52691b4dbfc 33 34 2018-03-30 Robin Morisset <rmorisset@apple.com> 35 36 Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType 37 https://bugs.webkit.org/show_bug.cgi?id=183657 38 39 Reviewed by Keith Miller. 40 41 * stress/large-unshift-splice.js: Added. 42 (make_contig_arr): 43 1 44 2018-02-21 Jason Marcell <jmarcell@apple.com> 2 45 -
branches/safari-605.1.33.0-branch/Source/JavaScriptCore/ChangeLog
r229123 r230605 1 2018-04-12 Kocsen Chung <kocsen_chung@apple.com> 2 3 Cherry-pick r230101. rdar://problem/39355291 4 5 Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType 6 https://bugs.webkit.org/show_bug.cgi?id=183657 7 JSTests: 8 9 Reviewed by Keith Miller. 10 11 * stress/large-unshift-splice.js: Added. 12 (make_contig_arr): 13 14 Source/JavaScriptCore: 15 16 <rdar://problem/38464399> 17 18 Reviewed by Keith Miller. 19 20 There was just a missing check in unshiftCountForIndexingType. 21 I've also replaced 'return false' by 'return true' in the case of an 'out-of-memory' exception, because 'return false' means 'please continue to the slow path', 22 and the slow path has an assert that there is no unhandled exception (line 360 of ArrayPrototype.cpp). 23 Finally, I made the assert in ensureLength a release assert as it would have caught this bug and prevented it from being a security risk. 24 25 * runtime/ArrayPrototype.cpp: 26 (JSC::unshift): 27 * runtime/JSArray.cpp: 28 (JSC::JSArray::unshiftCountWithAnyIndexingType): 29 * runtime/JSObject.h: 30 (JSC::JSObject::ensureLength): 31 32 git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230101 268f45cc-cd09-0410-ab3c-d52691b4dbfc 33 34 2018-03-30 Robin Morisset <rmorisset@apple.com> 35 36 Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType 37 https://bugs.webkit.org/show_bug.cgi?id=183657 38 <rdar://problem/38464399> 39 40 Reviewed by Keith Miller. 41 42 There was just a missing check in unshiftCountForIndexingType. 43 I've also replaced 'return false' by 'return true' in the case of an 'out-of-memory' exception, because 'return false' means 'please continue to the slow path', 44 and the slow path has an assert that there is no unhandled exception (line 360 of ArrayPrototype.cpp). 45 Finally, I made the assert in ensureLength a release assert as it would have caught this bug and prevented it from being a security risk. 46 47 * runtime/ArrayPrototype.cpp: 48 (JSC::unshift): 49 * runtime/JSArray.cpp: 50 (JSC::JSArray::unshiftCountWithAnyIndexingType): 51 * runtime/JSObject.h: 52 (JSC::JSObject::ensureLength): 53 1 54 2018-02-28 Jason Marcell <jmarcell@apple.com> 2 55 -
branches/safari-605.1.33.0-branch/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
r225150 r230605 347 347 348 348 // Guard against overflow. 349 if (count > (UINT_MAX - length)) {349 if (count > UINT_MAX - length) { 350 350 throwOutOfMemoryError(exec, scope); 351 351 return; -
branches/safari-605.1.33.0-branch/Source/JavaScriptCore/runtime/JSArray.cpp
r227912 r230605 1061 1061 return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm)); 1062 1062 } 1063 1063 1064 if (oldLength + count > MAX_STORAGE_VECTOR_LENGTH) 1065 return false; 1066 1064 1067 if (!ensureLength(vm, oldLength + count)) { 1065 1068 throwOutOfMemoryError(exec, scope); 1066 return false;1069 return true; 1067 1070 } 1068 1071 butterfly = this->butterfly(); … … 1105 1108 return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm)); 1106 1109 } 1107 1110 1111 if (oldLength + count > MAX_STORAGE_VECTOR_LENGTH) 1112 return false; 1113 1108 1114 if (!ensureLength(vm, oldLength + count)) { 1109 1115 throwOutOfMemoryError(exec, scope); 1110 return false;1116 return true; 1111 1117 } 1112 1118 butterfly = this->butterfly(); -
branches/safari-605.1.33.0-branch/Source/JavaScriptCore/runtime/JSObject.h
r227886 r230605 977 977 bool WARN_UNUSED_RETURN ensureLength(VM& vm, unsigned length) 978 978 { 979 ASSERT(length <= MAX_STORAGE_VECTOR_LENGTH);979 RELEASE_ASSERT(length <= MAX_STORAGE_VECTOR_LENGTH); 980 980 ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType())); 981 981
Note: See TracChangeset
for help on using the changeset viewer.