Changeset 281008 in webkit

Timestamp:

Aug 12, 2021, 10:45:45 PM (5 years ago)

Author:

Cameron McCormack

Message:

Fix bounds checks for WhitespaceCache string lengths
​https://bugs.webkit.org/show_bug.cgi?id=229066
<rdar://81850871>

Reviewed by Simon Fraser.

When the whitespace string length is maximumWhitespaceStringLength,
we read from and write to one element past the end of m_codes and
m_indexes. Since we don't need to store codes and indexes for zero
length strings, subtract one from the index we use.

• html/parser/HTMLConstructionSite.cpp:

(WebCore::WhitespaceCache::lookup):

• html/parser/HTMLConstructionSite.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/parser/HTMLConstructionSite.cpp (modified) (2 diffs)
• html/parser/HTMLConstructionSite.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-08-12  Cameron McCormack  <heycam@apple.com>
+
+        Fix bounds checks for WhitespaceCache string lengths
+        https://bugs.webkit.org/show_bug.cgi?id=229066
+        <rdar://81850871>
+
+        Reviewed by Simon Fraser.
+
+        When the whitespace string length is maximumWhitespaceStringLength,
+        we read from and write to one element past the end of m_codes and
+        m_indexes. Since we don't need to store codes and indexes for zero
+        length strings, subtract one from the index we use.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::WhitespaceCache::lookup):
+        * html/parser/HTMLConstructionSite.h:
+
 2021-08-12  David Kilzer  <ddkilzer@apple.com>
 

trunk/Source/WebCore/html/parser/HTMLConstructionSite.cpp

@@ -892 +892 @@
         return AtomString();
 
-    if (m_codes[length] == code) {
-        ASSERT(m_atoms[m_indexes[length]] == string);
-        return m_atoms[m_indexes[length]];
+    size_t lengthIndex = length - 1;
+    if (m_codes[lengthIndex] == code) {
+        ASSERT(m_atoms[m_indexes[lengthIndex]] == string);
+        return m_atoms[m_indexes[lengthIndex]];
     }
 
@@ -900 +901 @@
         return AtomString(string);
 
-    if (m_codes[length]) {
+    if (m_codes[lengthIndex]) {
         AtomString whitespaceAtom(string);
-        m_codes[length] = code;
-        m_atoms[m_indexes[length]] = whitespaceAtom;
+        m_codes[lengthIndex] = code;
+        m_atoms[m_indexes[lengthIndex]] = whitespaceAtom;
         return whitespaceAtom;
     }
 
     AtomString whitespaceAtom(string);
-    m_codes[length] = code;
-    m_indexes[length] = m_atoms.size();
+    m_codes[lengthIndex] = code;
+    m_indexes[lengthIndex] = m_atoms.size();
     m_atoms.append(whitespaceAtom);
     return whitespaceAtom;

trunk/Source/WebCore/html/parser/HTMLConstructionSite.h

@@ -239 +239 @@
 
     // Parallel arrays storing a 64 bit code and an index into m_atoms for the
-    // most recently atomized whitespace-only string of a given length.
+    // most recently atomized whitespace-only string of a given length. The
+    // indices into these two arrays are the string length minus 1, so the code
+    // for a whitespace-only string of length 2 is stored at m_codes[1], etc.
     uint64_t m_codes[maximumCachedStringLength] { 0 };
     uint8_t m_indexes[maximumCachedStringLength] { 0 };