Changeset 233610 in webkit

Timestamp:

Jul 6, 2018 7:24:35 PM (6 years ago)

Author:

chris.reid@sony.com

Message:

[WinCairo] WebKit MiniBrowser crashes when attempting to navigate to certain URLs
​https://bugs.webkit.org/show_bug.cgi?id=187167

Reviewed by Alex Christensen.

A null byte was written past the end of the buffer causing the crash.
Some of the heap allocated buffers were also not getting deleted.

• MiniBrowser/win/WebKitBrowserWindow.cpp:

Location:

trunk/Tools

Files:

• ChangeLog (modified) (1 diff)
• MiniBrowser/win/WebKitBrowserWindow.cpp (modified) (4 diffs)

trunk/Tools/ChangeLog

@@ +1 @@
+2018-07-06  Christopher Reid  <chris.reid@sony.com>
+
+        [WinCairo] WebKit MiniBrowser crashes when attempting to navigate to certain URLs
+        https://bugs.webkit.org/show_bug.cgi?id=187167
+
+        Reviewed by Alex Christensen.
+
+        A null byte was written past the end of the buffer causing the crash.
+        Some of the heap allocated buffers were also not getting deleted.
+
+        * MiniBrowser/win/WebKitBrowserWindow.cpp:
+
 2018-07-06  Thibault Saunier  <tsaunier@igalia.com>
 

trunk/Tools/MiniBrowser/win/WebKitBrowserWindow.cpp

@@ -28 +28 @@
 #include "MiniBrowserLibResource.h"
 #include <WebKit/WKInspector.h>
+#include <vector>
 
 std::wstring
 createString(WKStringRef wkString)
 {
-    size_t maxSize = WKStringGetMaximumUTF8CStringSize(wkString);
-    char* utf8Buffer = new char[maxSize];
-    size_t utf8Length = WKStringGetUTF8CString(wkString, utf8Buffer, maxSize);
-
-    int wcharLength = MultiByteToWideChar(CP_UTF8, 0, utf8Buffer, utf8Length, 0, 0);
-    wchar_t* wcharBuffer = new wchar_t[wcharLength + 1];
-    MultiByteToWideChar(CP_UTF8, 0, utf8Buffer, utf8Length, wcharBuffer, wcharLength);
-    wcharBuffer[wcharLength] = L'\0';
-    std::wstring dest(wcharBuffer);
-    return dest;
+    size_t maxSize = WKStringGetLength(wkString);
+
+    std::vector<WKChar> wkCharBuffer(maxSize);
+    size_t actualLength = WKStringGetCharacters(wkString, wkCharBuffer.data(), maxSize);
+    return std::wstring(wkCharBuffer.data(), actualLength);
 }
 
@@ -50 +46 @@
 }
 
-std::string toUtf8(const wchar_t* src, size_t srcLength)
+std::vector<char> toNullTerminatedUTF8(const wchar_t* src, size_t srcLength)
 {
     int utf8Length = WideCharToMultiByte(CP_UTF8, 0, src, srcLength, 0, 0, nullptr, nullptr);
-    char* utf8Buffer = new char[utf8Length];
+    std::vector<char> utf8Buffer(utf8Length + 1);
     WideCharToMultiByte(CP_UTF8, 0, src, srcLength,
-        utf8Buffer, utf8Length, nullptr, nullptr);
+        utf8Buffer.data(), utf8Length, nullptr, nullptr);
     utf8Buffer[utf8Length] = '\0';
-    std::string dest(utf8Buffer);
-    delete[] utf8Buffer;
-    return dest;
+    return utf8Buffer;
 }
 
@@ -65 +59 @@
 createWKString(_bstr_t str)
 {
-    auto utf8 = toUtf8(str, str.length());
-    return adoptWK(WKStringCreateWithUTF8CString(utf8.c_str()));
+    auto utf8 = toNullTerminatedUTF8(str, str.length());
+    return adoptWK(WKStringCreateWithUTF8CString(utf8.data()));
 }
 
@@ -72 +66 @@
 createWKURL(_bstr_t str)
 {
-    auto utf8 = toUtf8(str, str.length());
-    return adoptWK(WKURLCreateWithUTF8CString(utf8.c_str()));
+    auto utf8 = toNullTerminatedUTF8(str, str.length());
+    return adoptWK(WKURLCreateWithUTF8CString(utf8.data()));
 }