Changeset 201121 in webkit

Timestamp:

May 18, 2016, 6:01:21 PM (9 years ago)

Author:

sbarati@apple.com

Message:

StringBuilder::appendQuotedJSONString doesn't properly protect against the math it's doing. Make the math fit the assertion.
​https://bugs.webkit.org/show_bug.cgi?id=157868

Reviewed by Benjamin Poulain.

appendQuotedJSONString was rounding up to the next power of two when resizing
its buffer. Lets call the allocation size X. If X > 2^{31, then
roundUpToPowerOfTwo(X) == 0. This patch fixes this by making the
assertion reflect what the code is doing. We now allocate to a size
of X = std::max(maximumCapacityRequired , roundUpToPowerOfTwo(maximumCapacityRequired))}

• wtf/text/StringBuilder.cpp:

(WTF::StringBuilder::appendQuotedJSONString):

Location:

trunk/Source/WTF

Files:

• ChangeLog (modified) (1 diff)
• wtf/text/StringBuilder.cpp (modified) (1 diff)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2016-05-18  Saam barati  <sbarati@apple.com>
+
+        StringBuilder::appendQuotedJSONString doesn't properly protect against the math it's doing. Make the math fit the assertion.
+        https://bugs.webkit.org/show_bug.cgi?id=157868
+
+        Reviewed by Benjamin Poulain.
+
+        appendQuotedJSONString was rounding up to the next power of two when resizing
+        its buffer. Lets call the allocation size X. If X > 2^31, then
+        roundUpToPowerOfTwo(X) == 0. This patch fixes this by making the
+        assertion reflect what the code is doing. We now allocate to a size
+        of X = std::max(maximumCapacityRequired , roundUpToPowerOfTwo(maximumCapacityRequired))
+
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::appendQuotedJSONString):
+
 2016-05-17  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/WTF/wtf/text/StringBuilder.cpp

@@ -415 +415 @@
     size_t maximumCapacityRequired = length() + 2 + string.length() * 6;
     RELEASE_ASSERT(maximumCapacityRequired < std::numeric_limits<unsigned>::max());
+    unsigned allocationSize = maximumCapacityRequired;
+    // This max() is here to allow us to allocate sizes between the range [2^31, 2^32 - 2] because roundUpToPowerOfTwo(1<<31 + some int smaller than 1<<31) == 0.
+    allocationSize = std::max(allocationSize, roundUpToPowerOfTwo(allocationSize));
 
     if (is8Bit() && !string.is8Bit())
-        allocateBufferUpConvert(m_bufferCharacters8, roundUpToPowerOfTwo(maximumCapacityRequired));
+        allocateBufferUpConvert(m_bufferCharacters8, allocationSize);
     else
-        reserveCapacity(roundUpToPowerOfTwo(maximumCapacityRequired));
+        reserveCapacity(allocationSize);
 
     if (is8Bit()) {