Changeset 275048 in webkit

Timestamp:

Mar 25, 2021, 11:20:58 AM (5 years ago)

Author:

Chris Dumez

Message:

Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107:33: runtime error: signed integer overflow: 268435455 * 16 cannot be represented in type 'int'
​https://bugs.webkit.org/show_bug.cgi?id=223718

Reviewed by Darin Adler.

Use Checked<> for the result in consumeCharacterReference() to deal with overflows
in a well-defined manner.

• xml/parser/CharacterReferenceParserInlines.h:

(WebCore::consumeCharacterReference):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• xml/parser/CharacterReferenceParserInlines.h (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-25  Chris Dumez  <cdumez@apple.com>
+
+        Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107:33: runtime error: signed integer overflow: 268435455 * 16 cannot be represented in type 'int'
+        https://bugs.webkit.org/show_bug.cgi?id=223718
+
+        Reviewed by Darin Adler.
+
+        Use Checked<> for the result in consumeCharacterReference() to deal with overflows
+        in a well-defined manner.
+
+        * xml/parser/CharacterReferenceParserInlines.h:
+        (WebCore::consumeCharacterReference):
+
 2021-03-25  John Wilander  <wilander@apple.com>
 

trunk/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h

@@ -52 +52 @@
         Named
     } state = Initial;
-    UChar32 result = 0;
-    bool overflow = false;
+    Checked<UChar32, RecordOverflow> result = 0;
     StringBuilder consumedCharacters;
     
@@ -105 +104 @@
         Hex:
             if (isASCIIHexDigit(character)) {
-                result = result * 16 + toASCIIHexValue(character);
-                if (result > UCHAR_MAX_VALUE)
-                    overflow = true;
+                result *= 16;
+                result += static_cast<UChar32>(toASCIIHexValue(character));
                 break;
             }
             if (character == ';') {
                 source.advancePastNonNewline();
-                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
                 return true;
             }
             if (ParserFunctions::acceptMalformed()) {
-                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
                 return true;
             }
@@ -124 +122 @@
         Decimal:
             if (isASCIIDigit(character)) {
-                result = result * 10 + character - '0';
-                if (result > UCHAR_MAX_VALUE)
-                    overflow = true;
+                result *= 10;
+                result += (character - '0');
                 break;
             }
             if (character == ';') {
                 source.advancePastNonNewline();
-                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
                 return true;
             }
             if (ParserFunctions::acceptMalformed()) {
-                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+                decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
                 return true;
             }