Changeset 172725 in webkit

Timestamp:

Aug 18, 2014 2:14:35 PM (10 years ago)

Author:

commit-queue@webkit.org

Message:

Fix unintentional integer overflow before widen
​https://bugs.webkit.org/show_bug.cgi?id=135463

Patch by Przemyslaw Kuczynski <​p.kuczynski@samsung.com> on 2014-08-18
Reviewed by Oliver Hunt.

Overflowing expression is evaluated using operands arithmetic but then is used in
context which expects an wider integer type. To avoid overflow at least one operand
has to be representative of the wider type.

Source/WebCore:

• loader/FTPDirectoryParser.cpp:

(WebCore::parseOneFTPLine): Changed strtoul to strtoull.

• loader/ProgressTracker.cpp:

(WebCore::ProgressTracker::incrementProgress): Added static_cast to long long.

• platform/efl/FileSystemEfl.cpp:

(WebCore::getVolumeFreeSizeForPath): Added static_cast to uint64_t.

Source/WebKit2:

• WebProcess/soup/WebProcessSoup.cpp:

(WebKit::getMemorySize): Added long long literal.

Location:

trunk/Source

Files:

• WebCore/ChangeLog (modified) (1 diff)
• WebCore/loader/FTPDirectoryParser.cpp (modified) (1 diff)
• WebCore/loader/ProgressTracker.cpp (modified) (1 diff)
• WebCore/platform/efl/FileSystemEfl.cpp (modified) (1 diff)
• WebKit2/ChangeLog (modified) (1 diff)
• WebKit2/WebProcess/soup/WebProcessSoup.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-08-18  Przemyslaw Kuczynski  <p.kuczynski@samsung.com>
+
+        Fix unintentional integer overflow before widen
+        https://bugs.webkit.org/show_bug.cgi?id=135463
+
+        Reviewed by Oliver Hunt.
+
+        Overflowing expression is evaluated using operands arithmetic but then is used in
+        context which expects an wider integer type. To avoid overflow at least one operand
+        has to be representative of the wider type.
+
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::parseOneFTPLine): Changed strtoul to strtoull.
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::incrementProgress): Added static_cast to long long.
+        * platform/efl/FileSystemEfl.cpp:
+        (WebCore::getVolumeFreeSizeForPath): Added static_cast to uint64_t.
+
 2014-08-18  Vivek Galatage  <vivek.vg@samsung.com>
 

trunk/Source/WebCore/loader/FTPDirectoryParser.cpp

@@ -506 +506 @@
                * than not showing the size at all.
               */
-              uint64_t size = strtoul(tokens[1], NULL, 10) * 512;
+              uint64_t size = strtoull(tokens[1], 0, 10) * 512;
               result.fileSize = String::number(size);
             } 

trunk/Source/WebCore/loader/ProgressTracker.cpp

@@ -235 +235 @@
     
     int numPendingOrLoadingRequests = frame->loader().numPendingOrLoadingRequests(true);
-    estimatedBytesForPendingRequests = progressItemDefaultEstimatedLength * numPendingOrLoadingRequests;
+    estimatedBytesForPendingRequests = static_cast<long long>(progressItemDefaultEstimatedLength) * numPendingOrLoadingRequests;
     remainingBytes = ((m_totalPageAndResourceBytesToLoad + estimatedBytesForPendingRequests) - m_totalBytesReceived);
     if (remainingBytes > 0)  // Prevent divide by 0.

trunk/Source/WebCore/platform/efl/FileSystemEfl.cpp

@@ -106 +106 @@
         return 0;
 
-    return buf.f_bavail * buf.f_bsize;
+    return static_cast<uint64_t>(buf.f_bavail) * buf.f_bsize;
 }
 

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-08-18  Przemyslaw Kuczynski  <p.kuczynski@samsung.com>
+
+        Fix unintentional integer overflow before widen
+        https://bugs.webkit.org/show_bug.cgi?id=135463
+
+        Reviewed by Oliver Hunt.
+
+        Overflowing expression is evaluated using operands arithmetic but then is used in
+        context which expects an wider integer type. To avoid overflow at least one operand
+        has to be representative of the wider type.
+
+        * WebProcess/soup/WebProcessSoup.cpp:
+        (WebKit::getMemorySize): Added long long literal.
+
 2014-08-18  Przemyslaw Kuczynski  <p.kuczynski@samsung.com>
 

trunk/Source/WebKit2/WebProcess/soup/WebProcessSoup.cpp

@@ -75 +75 @@
         return kDefaultMemorySize;
 
-    return ((pageSize / 1024) * physPages) / 1024;
+    return ((pageSize / 1024LL) * physPages) / 1024LL;
 #else
     // Fallback to default for other platforms.