Changeset 254218 in webkit

Timestamp:

Jan 8, 2020, 12:54:09 PM (7 years ago)

Author:

msaboff@apple.com

Message:

JSArrayBufferView.h: Multiplication result converted to larger type
​https://bugs.webkit.org/show_bug.cgi?id=205943

Reviewed by Saam Barati.

Added cast to size_t to make the whole calculation size_t.

• runtime/JSArrayBufferView.h:

(JSC::JSArrayBufferView::sizeOf):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSArrayBufferView.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-01-08  Michael Saboff  <msaboff@apple.com>
+
+        JSArrayBufferView.h: Multiplication result converted to larger type
+        https://bugs.webkit.org/show_bug.cgi?id=205943
+
+        Reviewed by Saam Barati.
+
+        Added cast to size_t to make the whole calculation size_t.
+
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::sizeOf):
+
 2020-01-08  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h

@@ -109 +109 @@
     static size_t sizeOf(uint32_t length, uint32_t elementSize)
     {
-        return (length * elementSize + sizeof(EncodedJSValue) - 1)
+        return (static_cast<size_t>(length) * elementSize + sizeof(EncodedJSValue) - 1)
             & ~(sizeof(EncodedJSValue) - 1);
     }