Changeset 162544 in webkit

Timestamp:

Jan 22, 2014 11:55:11 AM (10 years ago)

Author:

commit-queue@webkit.org

Message:

Crashes in setTextForIterator
​https://bugs.webkit.org/show_bug.cgi?id=127424

Patch by ​peavo@outlook.com <​peavo@outlook.com> on 2014-01-22
Reviewed by Brent Fulgham.

• platform/text/icu/UTextProviderLatin1.cpp:

(WebCore::uTextLatin1Clone): Provide correct buffer size in utext_setup function call.
(WebCore::uTextLatin1Access): Give correct buffer size to memset call.
(WebCore::openLatin1UTextProvider): Ditto.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/text/icu/UTextProviderLatin1.cpp (modified) (4 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-01-22  peavo@outlook.com  <peavo@outlook.com>
+
+        Crashes in setTextForIterator
+        https://bugs.webkit.org/show_bug.cgi?id=127424
+
+        Reviewed by Brent Fulgham.
+
+        * platform/text/icu/UTextProviderLatin1.cpp:
+        (WebCore::uTextLatin1Clone): Provide correct buffer size in utext_setup function call.
+        (WebCore::uTextLatin1Access): Give correct buffer size to memset call.
+        (WebCore::openLatin1UTextProvider): Ditto.
+
 2014-01-22  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp

@@ -68 +68 @@
         return 0;
 
-    UText* result = utext_setup(destination, sizeof(UChar) * (UTextWithBufferInlineCapacity + 1), status);
+    UText* result = utext_setup(destination, sizeof(UChar) * UTextWithBufferInlineCapacity, status);
     if (U_FAILURE(*status))
         return destination;
@@ -83 +83 @@
     result->pFuncs = &uTextLatin1Funcs;
     result->chunkContents = (UChar*)result->pExtra;
-    memset(const_cast<UChar*>(result->chunkContents), 0, sizeof(UChar) * (UTextWithBufferInlineCapacity + 1));
+    memset(const_cast<UChar*>(result->chunkContents), 0, sizeof(UChar) * UTextWithBufferInlineCapacity);
 
     return result;
@@ -133 +133 @@
             uText->chunkNativeLimit = length;
 
-        uText->chunkNativeStart = uText->chunkNativeLimit -  UTextWithBufferInlineCapacity;
+        uText->chunkNativeStart = uText->chunkNativeLimit - UTextWithBufferInlineCapacity;
         if (uText->chunkNativeStart < 0)
             uText->chunkNativeStart = 0;
@@ -229 +229 @@
     text->pFuncs = &uTextLatin1Funcs;
     text->chunkContents = (UChar*)text->pExtra;
-    memset(const_cast<UChar*>(text->chunkContents), 0, sizeof(UChar) * (UTextWithBufferInlineCapacity + 1));
+    memset(const_cast<UChar*>(text->chunkContents), 0, sizeof(UChar) * UTextWithBufferInlineCapacity);
 
     return text;