Changeset 19430 in webkit

Timestamp:

Feb 6, 2007 8:41:45 AM (17 years ago)

Author:

brmorris

Message:

vbradley, reviewed by Yongjun.

DESC: Fixed the stack size and pcre stack overflow ALAA-6XSF7U
Limit the number recursions that are allowed in match().
​http://bugs.webkit.org/show_bug.cgi?id=12611

Location:

S60/branches/3.1m

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/group/JavaScriptCore.mmp (modified) (1 diff)
• JavaScriptCore/pcre/pcre.c (modified) (8 diffs)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/group/WebCore.mmp (modified) (1 diff)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/group/webkit.mmp (modified) (1 diff)

S60/branches/3.1m/JavaScriptCore/ChangeLog

@@ +1 @@
+vbradley, reviewed by Yongjun.
+        DESC: Fixed the stack size and pcre stack overflow ALAA-6XSF7U
+        Limit the number recursions that are allowed in match().
+        http://bugs.webkit.org/show_bug.cgi?id=12611
+
+        * group/JavaScriptCore.mmp:
+        * pcre/pcre.c:
+        (match):
+
 yongjzha, Reviewed by zalan.
         DESC: backport google.com/ig refreshing memory leak fix in <http://bugs.webkit.org/show_bug.cgi?id=10773> PPEN-6QYG7L

S60/branches/3.1m/JavaScriptCore/group/JavaScriptCore.mmp

@@ -32 +32 @@
 
 EPOCALLOWDLLDATA
+// heap size 20K - 16M
 EPOCHEAPSIZE 0x5000 0x1000000
+// stack size 64K
+epocstacksize 0x10000
 
 #if defined(ARMCC)

S60/branches/3.1m/JavaScriptCore/pcre/pcre.c

@@ -3649 +3649 @@
 
 
+#if NOKIA_CHANGES
+// Prototype match_internal()
+static BOOL
+match_internal(register const ichar *eptr, register const uschar *ecode,
+               int offset_top, match_data *md, unsigned long int ims,
+               eptrblock *eptrb, int flags);
 
 /*************************************************
@@ -3673 +3679 @@
 Returns:       TRUE if matched
 */
-
 static BOOL
 match(register const ichar *eptr, register const uschar *ecode,
@@ -3679 +3684 @@
   int flags)
 {
+    static int matchcount = 0;
+    static int matchcountMax = 0;
+    BOOL err;
+
+    if ( matchcountMax >= 250 )
+        {
+        return FALSE;
+        }
+
+    ++matchcount;
+
+    if ( matchcountMax < matchcount )
+        {
+        matchcountMax = matchcount;
+        }
+        
+    err = match_internal(eptr, ecode, offset_top, md, ims, eptrb, flags);
+
+    --matchcount;
+    if ( matchcount <= 0 )
+        {
+        matchcountMax = 0;
+        }
+
+    return err;
+}
+#endif  // end of NOKIA_CHANGES
+
+/*************************************************
+*         Match from current position            *
+*************************************************/
+
+/* On entry ecode points to the first opcode, and eptr to the first character
+in the subject string, while eptrb holds the value of eptr at the start of the
+last bracketed group - used for breaking infinite loops matching zero-length
+strings.
+
+Arguments:
+   eptr        pointer in subject
+   ecode       position in code
+   offset_top  current top pointer
+   md          pointer to "static" info for the match
+   ims         current /i, /m, and /s options
+   eptrb       pointer to chain of blocks containing eptr at start of
+                 brackets - for testing for empty matches
+   flags       can contain
+                 match_condassert - this is an assertion condition
+                 match_isgroup - this is the start of a bracketed group
+
+Returns:       TRUE if matched
+*/
+
+#if NOKIA_CHANGES
+static BOOL
+match_internal(register const ichar *eptr, register const uschar *ecode,
+  int offset_top, match_data *md, unsigned long int ims, eptrblock *eptrb,
+  int flags)
+#else
+match(register const ichar *eptr, register const uschar *ecode,
+  int offset_top, match_data *md, unsigned long int ims, eptrblock *eptrb,
+  int flags)
+#endif
+{
+
 unsigned long int original_ims = ims;   /* Save for resetting on ')' */
 eptrblock newptrb;
@@ -4532 +4601 @@
           ichar c1 = *ecode++;
 #endif
-                        {
+            {
           ichar c2 = *eptr++;
           if (MAPCHAR(md->lcc, c1) != MAPCHAR(md->lcc, c2))
             return FALSE;
           }
-                  }
+          }
         }
       else
@@ -4623 +4692 @@
           if (i >= max || eptr >= md->end_subject)
             return FALSE;
-                        {
+            {
           ichar c2 = *eptr++;
           if (c != MAPCHAR(md->lcc, c2))
             return FALSE;
-                        }
+            }
           }
         /* Control never gets here */
@@ -4683 +4752 @@
     case OP_NOT: {
     if (eptr >= md->end_subject) return FALSE;
-          {
+      {
 #if PCRE_UTF16
     int c = (ecode[1] << 8) | ecode[2];
@@ -4701 +4770 @@
       }
     }
-          }
+      }
     break;
 
@@ -4776 +4845 @@
           if (i >= max || eptr >= md->end_subject)
             return FALSE;
-                        {
+            {
           ichar c2 = *eptr++;
           if (c == MAPCHAR(md->lcc, c2))
             return FALSE;
-                        }
+            }
           }
         /* Control never gets here */

S60/branches/3.1m/WebCore/ChangeLog

@@ +1 @@
+vbradley, reviewed by Yongjun.
+        DESC: Fixed the stack size and pcre stack overflow ALAA-6XSF7U
+        Limit the number recursions that are allowed in match().
+        http://bugs.webkit.org/show_bug.cgi?id=12611
+
+
+        WARNING: NO TEST CASES ADDED OR CHANGED
+
+        * group/WebCore.mmp:
+
 bujtas, Reviewed by yongjun.
         DESC: browser is crashing if it is closed while a page is loading and closing and opening a new window crashes the browser as well TMCN-6XRQP2 

S60/branches/3.1m/WebCore/group/WebCore.mmp

@@ -25 +25 @@
 epocallowdlldata
 VENDORID    VID_DEFAULT
+// stack size 64K
+epocstacksize 0x10000
 
 LANG     SC

S60/branches/3.1m/WebKit/ChangeLog

@@ +1 @@
+vbradley, reviewed by Yongjun.
+        DESC: Fixed the stack size and pcre stack overflow ALAA-6XSF7U
+        Limit the number recursions that are allowed in match().
+        http://bugs.webkit.org/show_bug.cgi?id=12611
+
+        * group/webkit.mmp:
+
 bujtas, reviewed by yongjun.
         DESC: closing the window while the page is loading still crashes the browser TMCN-6XRQP2

S60/branches/3.1m/WebKit/group/webkit.mmp

@@ -53 +53 @@
 CAPABILITY  CAP_GENERAL_DLL
 EPOCALLOWDLLDATA
+// stack size 64K
+epocstacksize 0x10000
 
 MACRO __OOM__