⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 245689 in webkit


Ignore:
Timestamp:
May 23, 2019, 10:00:56 AM (7 years ago)
Author:
Kocsen Chung
Message:

Cherry-pick r245622. rdar://problem/50754184

[JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
​https://bugs.webkit.org/show_bug.cgi?id=198101

Reviewed by Michael Saboff.

JSTests:

  • stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added. (shouldBe):

Source/JavaScriptCore:

When we allocate 0-length ArrayBuffer, we allocate 1 byte storage instead because we would like to ensure that
non-neutered ArrayBuffer always have non nullptr. While we allocate a 1 byte storage, this ArrayBuffer says
sizeInBytes = 0. However, we accidentally configure the vector pointer with this 1 byte size in the constructor.
In ARM64E device, we sign the vector pointer with modifier = 1 (1 byte size), and later we authenticate this
pointer with modifier = 0 (sizeInBytes), and fail to authenticate the pointer.

In this patch, we sign the pointer with sizeInBytes so that we correctly authenticate the 0 bytes vector pointer.

  • runtime/ArrayBuffer.cpp: (JSC::ArrayBufferContents::tryAllocate):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245622 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-608.1.24.20-branch
Files:
1 added
3 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-608.1.24.20-branch/JSTests/ChangeLog

    r245084 r245689  
     12019-05-23  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245622. rdar://problem/50754184
     4
     5    [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
     6    https://bugs.webkit.org/show_bug.cgi?id=198101
     7   
     8    Reviewed by Michael Saboff.
     9   
     10    JSTests:
     11   
     12    * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
     13    (shouldBe):
     14   
     15    Source/JavaScriptCore:
     16   
     17    When we allocate 0-length ArrayBuffer, we allocate 1 byte storage instead because we would like to ensure that
     18    non-neutered ArrayBuffer always have non nullptr. While we allocate a 1 byte storage, this ArrayBuffer says
     19    sizeInBytes = 0. However, we accidentally configure the vector pointer with this 1 byte size in the constructor.
     20    In ARM64E device, we sign the vector pointer with modifier = 1 (1 byte size), and later we authenticate this
     21    pointer with modifier = 0 (sizeInBytes), and fail to authenticate the pointer.
     22   
     23    In this patch, we sign the pointer with sizeInBytes so that we correctly authenticate the 0 bytes vector pointer.
     24   
     25    * runtime/ArrayBuffer.cpp:
     26    (JSC::ArrayBufferContents::tryAllocate):
     27   
     28   
     29    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245622 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     30
     31    2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
     32
     33            [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
     34            https://bugs.webkit.org/show_bug.cgi?id=198101
     35
     36            Reviewed by Michael Saboff.
     37
     38            * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
     39            (shouldBe):
     40
    1412019-05-08  Saam barati  <sbarati@apple.com>
    242

  • branches/safari-608.1.24.20-branch/Source/JavaScriptCore/ChangeLog

    r245378 r245689  
     12019-05-23  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245622. rdar://problem/50754184
     4
     5    [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
     6    https://bugs.webkit.org/show_bug.cgi?id=198101
     7   
     8    Reviewed by Michael Saboff.
     9   
     10    JSTests:
     11   
     12    * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
     13    (shouldBe):
     14   
     15    Source/JavaScriptCore:
     16   
     17    When we allocate 0-length ArrayBuffer, we allocate 1 byte storage instead because we would like to ensure that
     18    non-neutered ArrayBuffer always have non nullptr. While we allocate a 1 byte storage, this ArrayBuffer says
     19    sizeInBytes = 0. However, we accidentally configure the vector pointer with this 1 byte size in the constructor.
     20    In ARM64E device, we sign the vector pointer with modifier = 1 (1 byte size), and later we authenticate this
     21    pointer with modifier = 0 (sizeInBytes), and fail to authenticate the pointer.
     22   
     23    In this patch, we sign the pointer with sizeInBytes so that we correctly authenticate the 0 bytes vector pointer.
     24   
     25    * runtime/ArrayBuffer.cpp:
     26    (JSC::ArrayBufferContents::tryAllocate):
     27   
     28   
     29    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245622 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     30
     31    2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
     32
     33            [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
     34            https://bugs.webkit.org/show_bug.cgi?id=198101
     35
     36            Reviewed by Michael Saboff.
     37
     38            When we allocate 0-length ArrayBuffer, we allocate 1 byte storage instead because we would like to ensure that
     39            non-neutered ArrayBuffer always have non nullptr. While we allocate a 1 byte storage, this ArrayBuffer says
     40            sizeInBytes = 0. However, we accidentally configure the vector pointer with this 1 byte size in the constructor.
     41            In ARM64E device, we sign the vector pointer with modifier = 1 (1 byte size), and later we authenticate this
     42            pointer with modifier = 0 (sizeInBytes), and fail to authenticate the pointer.
     43
     44            In this patch, we sign the pointer with sizeInBytes so that we correctly authenticate the 0 bytes vector pointer.
     45
     46            * runtime/ArrayBuffer.cpp:
     47            (JSC::ArrayBufferContents::tryAllocate):
     48
    1492019-05-15  Kocsen Chung  <kocsen_chung@apple.com>
    250

  • branches/safari-608.1.24.20-branch/Source/JavaScriptCore/runtime/ArrayBuffer.cpp

    r245064 r245689  
    107107        }
    108108    }
    109     size_t size = static_cast<size_t>(numElements) * static_cast<size_t>(elementByteSize);
    110     if (!size)
    111         size = 1; // Make sure malloc actually allocates something, but not too much. We use null to mean that the buffer is neutered.
    112 
    113     void* data = Gigacage::tryMalloc(Gigacage::Primitive, numElements * elementByteSize);
    114     m_data = DataType(data, size);
     109    size_t sizeInBytes = static_cast<size_t>(numElements) * static_cast<size_t>(elementByteSize);
     110    size_t allocationSize = sizeInBytes;
     111    if (!allocationSize)
     112        allocationSize = 1; // Make sure malloc actually allocates something, but not too much. We use null to mean that the buffer is neutered.
     113
     114    void* data = Gigacage::tryMalloc(Gigacage::Primitive, allocationSize);
     115    m_data = DataType(data, sizeInBytes);
    115116    if (!data) {
    116117        reset();
    … …  
    119120   
    120121    if (policy == ZeroInitialize)
    121         memset(data, 0, size);
    122 
    123     m_sizeInBytes = numElements * elementByteSize;
     122        memset(data, 0, allocationSize);
     123
     124    m_sizeInBytes = sizeInBytes;
    124125    RELEASE_ASSERT(m_sizeInBytes <= MAX_ARRAY_BUFFER_SIZE);
    125126    m_destructor = [] (void* p) { Gigacage::free(Gigacage::Primitive, p); };
Note: See TracChangeset for help on using the changeset viewer.