Changeset 236969 in webkit

Timestamp:

Oct 9, 2018 11:15:56 AM (6 years ago)

Author:

mark.lam@apple.com

Message:

StringTypeAdapter constructor is not properly enforcing String::MaxLength.
​https://bugs.webkit.org/show_bug.cgi?id=190392
<rdar://problem/45116210>

Reviewed by Saam Barati.

Previously, the StringTypeAdapter constructor for a UChar* string was summing the
unsigned length of the source string without an overflow check. We now make that
length a size_t which removes this issue, and assert that it's within
String::MaxLength thereafter.

Also made the StringTypeAdapter constructor for a LChar* string behave in an
equivalent manner for consistency. In both cases, we'll crash in a RELEASE_ASSERT
if the source string length exceeds String::MaxLength.

• wtf/text/StringConcatenate.h:

Location:

trunk/Source/WTF

Files:

• ChangeLog (modified) (1 diff)
• wtf/text/StringConcatenate.h (modified) (2 diffs)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2018-10-09  Mark Lam  <mark.lam@apple.com>
+
+        StringTypeAdapter constructor is not properly enforcing String::MaxLength.
+        https://bugs.webkit.org/show_bug.cgi?id=190392
+        <rdar://problem/45116210>
+
+        Reviewed by Saam Barati.
+
+        Previously, the StringTypeAdapter constructor for a UChar* string was summing the
+        unsigned length of the source string without an overflow check.  We now make that
+        length a size_t which removes this issue, and assert that it's within
+        String::MaxLength thereafter.
+
+        Also made the StringTypeAdapter constructor for a LChar* string behave in an
+        equivalent manner for consistency.  In both cases, we'll crash in a RELEASE_ASSERT
+        if the source string length exceeds String::MaxLength.
+
+        * wtf/text/StringConcatenate.h:
+
 2018-10-09  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/WTF/wtf/text/StringConcatenate.h

@@ -109 +109 @@
     StringTypeAdapter(const LChar* characters)
         : m_characters(characters)
-        , m_length(strlen(reinterpret_cast<const char*>(characters)))
-    {
+    {
+        size_t length = strlen(reinterpret_cast<const char*>(characters));
+        RELEASE_ASSERT(length <= String::MaxLength);
+        m_length = static_cast<unsigned>(length);
     }
 
@@ -139 +141 @@
         : m_characters(characters)
     {
-        unsigned length = 0;
+        size_t length = 0;
         while (m_characters[length])
             ++length;
-
         RELEASE_ASSERT(length <= String::MaxLength);
-        m_length = length;
+        m_length = static_cast<unsigned>(length);
     }