Changeset 98374 in webkit

Timestamp:

Oct 25, 2011, 12:28:15 PM (15 years ago)

Author:

cevans@google.com

Message:

Manage the CSS property array length correctly
​https://bugs.webkit.org/show_bug.cgi?id=70783

Reviewed by Adam Barth.

• css/CSSParser.cpp:

(WebCore::CSSParser::addProperty): don't allow max length to get out of sync with the buffer.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• css/CSSParser.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-10-25  Chris Evans  <cevans@google.com>
+
+        Manage the CSS property array length correctly
+        https://bugs.webkit.org/show_bug.cgi?id=70783
+
+        Reviewed by Adam Barth.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addProperty): don't allow max length to get out of sync with the buffer.
+
 2011-10-25  Tony Chang  <tony@chromium.org>
 

trunk/Source/WebCore/css/CSSParser.cpp

@@ -614 +614 @@
     OwnPtr<CSSProperty> prop(adoptPtr(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand)));
     if (m_numParsedProperties >= m_maxParsedProperties) {
+        if (m_numParsedProperties > (UINT_MAX / sizeof(CSSProperty*)) - 32)
+            CRASH();  // Avoid inconsistencies with rollbackLastProperties.
         m_maxParsedProperties += 32;
-        if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
-            return;
         m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
             m_maxParsedProperties * sizeof(CSSProperty*)));