Changeset 259780 in webkit

Timestamp:

Apr 8, 2020, 9:33:27 PM (6 years ago)

Author:

ddkilzer@apple.com

Message:

WTF::Persistence::VectorCoder and IPC::VectorArgumentCoder should use checked arithmetic
<​https://webkit.org/b/210227>
<rdar://problem/60832243>

Reviewed by Alex Christensen.

Source/WebKit:

• Platform/IPC/ArgumentCoders.h:

(IPC::VectorArgumentCoder::decode):

• Use safeCast<> to cast from uint64_t to size_t.
• Use checked arithemtic for multiplication.

Source/WTF:

• wtf/persistence/PersistentCoders.h:

(WTF::Persistence::VectorCoder::decode):

• Use checked arithemtic for multiplication.

Location:

trunk/Source

Files:

• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/persistence/PersistentCoders.h (modified) (3 diffs)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/Platform/IPC/ArgumentCoders.h (modified) (6 diffs)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2020-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        WTF::Persistence::VectorCoder and IPC::VectorArgumentCoder should use checked arithmetic
+        <https://webkit.org/b/210227>
+        <rdar://problem/60832243>
+
+        Reviewed by Alex Christensen.
+
+        * wtf/persistence/PersistentCoders.h:
+        (WTF::Persistence::VectorCoder::decode):
+        - Use checked arithemtic for multiplication.
+
 2020-04-08  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WTF/wtf/persistence/PersistentCoders.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2010, 2014-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2010-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27 +27 @@
 
 #include <utility>
+#include <wtf/CheckedArithmetic.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -171 +172 @@
         temp.grow(size);
 
-        decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(temp.data()), size * sizeof(T));
+        Checked<size_t> checkedSize(size);
+        decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(temp.data()), (checkedSize * sizeof(T)).unsafeGet());
 
         vector.swap(temp);

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        WTF::Persistence::VectorCoder and IPC::VectorArgumentCoder should use checked arithmetic
+        <https://webkit.org/b/210227>
+        <rdar://problem/60832243>
+
+        Reviewed by Alex Christensen.
+
+        * Platform/IPC/ArgumentCoders.h:
+        (IPC::VectorArgumentCoder::decode):
+        - Use safeCast<> to cast from uint64_t to size_t.
+        - Use checked arithemtic for multiplication.
+
 2020-04-08  Alexey Proskuryakov  <ap@apple.com>
 

trunk/Source/WebKit/Platform/IPC/ArgumentCoders.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2010-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2010-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30 +30 @@
 #include <utility>
 #include <wtf/Box.h>
+#include <wtf/CheckedArithmetic.h>
 #include <wtf/Forward.h>
 #include <wtf/MonotonicTime.h>
@@ -366 +367 @@
     static bool decode(Decoder& decoder, Vector<T, inlineCapacity, OverflowHandler, minCapacity>& vector)
     {
-        uint64_t size;
-        if (!decoder.decode(size))
-            return false;
+        uint64_t decodedSize;
+        if (!decoder.decode(decodedSize))
+            return false;
+
+        auto size = safeCast<size_t>(decodedSize);
 
         // Since we know the total size of the elements, we can allocate the vector in
@@ -381 +384 @@
         temp.grow(size);
 
-        if (!decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(temp.data()), size * sizeof(T), alignof(T))) {
+        Checked<size_t> checkedSize(size);
+        if (!decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(temp.data()), (checkedSize * sizeof(T)).unsafeGet(), alignof(T))) {
             decoder.markInvalid();
             return false;
@@ -392 +396 @@
     static Optional<Vector<T, inlineCapacity, OverflowHandler, minCapacity>> decode(Decoder& decoder)
     {
-        uint64_t size;
-        if (!decoder.decode(size))
-            return WTF::nullopt;
-        
+        uint64_t decodedSize;
+        if (!decoder.decode(decodedSize))
+            return WTF::nullopt;
+
+        auto size = safeCast<size_t>(decodedSize);
+
         // Since we know the total size of the elements, we can allocate the vector in
         // one fell swoop. Before allocating we must however make sure that the decoder buffer
@@ -407 +413 @@
         vector.grow(size);
 
-        if (!decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(vector.data()), size * sizeof(T), alignof(T))) {
+        Checked<size_t> checkedSize(size);
+        if (!decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(vector.data()), (checkedSize * sizeof(T)).unsafeGet(), alignof(T))) {
             decoder.markInvalid();
             return WTF::nullopt;