Changeset 245622 in webkit

Timestamp:

May 22, 2019 10:21:19 AM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
​https://bugs.webkit.org/show_bug.cgi?id=198101

Reviewed by Michael Saboff.

JSTests:

• stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.

(shouldBe):

Source/JavaScriptCore:

When we allocate 0-length ArrayBuffer, we allocate 1 byte storage instead because we would like to ensure that
non-neutered ArrayBuffer always have non nullptr. While we allocate a 1 byte storage, this ArrayBuffer says
sizeInBytes = 0. However, we accidentally configure the vector pointer with this 1 byte size in the constructor.
In ARM64E device, we sign the vector pointer with modifier = 1 (1 byte size), and later we authenticate this
pointer with modifier = 0 (sizeInBytes), and fail to authenticate the pointer.

In this patch, we sign the pointer with sizeInBytes so that we correctly authenticate the 0 bytes vector pointer.

• runtime/ArrayBuffer.cpp:

(JSC::ArrayBufferContents::tryAllocate):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ArrayBuffer.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
+        https://bugs.webkit.org/show_bug.cgi?id=198101
+
+        Reviewed by Michael Saboff.
+
+        * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
+        (shouldBe):
+
 2019-05-20  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
+        https://bugs.webkit.org/show_bug.cgi?id=198101
+
+        Reviewed by Michael Saboff.
+
+        When we allocate 0-length ArrayBuffer, we allocate 1 byte storage instead because we would like to ensure that
+        non-neutered ArrayBuffer always have non nullptr. While we allocate a 1 byte storage, this ArrayBuffer says
+        sizeInBytes = 0. However, we accidentally configure the vector pointer with this 1 byte size in the constructor.
+        In ARM64E device, we sign the vector pointer with modifier = 1 (1 byte size), and later we authenticate this
+        pointer with modifier = 0 (sizeInBytes), and fail to authenticate the pointer.
+
+        In this patch, we sign the pointer with sizeInBytes so that we correctly authenticate the 0 bytes vector pointer.
+
+        * runtime/ArrayBuffer.cpp:
+        (JSC::ArrayBufferContents::tryAllocate):
+
 2019-05-21  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp

@@ -107 +107 @@
         }
     }
-    size_t size = static_cast<size_t>(numElements) * static_cast<size_t>(elementByteSize);
-    if (!size)
-        size = 1; // Make sure malloc actually allocates something, but not too much. We use null to mean that the buffer is neutered.
-
-    void* data = Gigacage::tryMalloc(Gigacage::Primitive, numElements * elementByteSize);
-    m_data = DataType(data, size);
+    size_t sizeInBytes = static_cast<size_t>(numElements) * static_cast<size_t>(elementByteSize);
+    size_t allocationSize = sizeInBytes;
+    if (!allocationSize)
+        allocationSize = 1; // Make sure malloc actually allocates something, but not too much. We use null to mean that the buffer is neutered.
+
+    void* data = Gigacage::tryMalloc(Gigacage::Primitive, allocationSize);
+    m_data = DataType(data, sizeInBytes);
     if (!data) {
         reset();
@@ -119 +120 @@
     
     if (policy == ZeroInitialize)
-        memset(data, 0, size);
-
-    m_sizeInBytes = numElements * elementByteSize;
+        memset(data, 0, allocationSize);
+
+    m_sizeInBytes = sizeInBytes;
     RELEASE_ASSERT(m_sizeInBytes <= MAX_ARRAY_BUFFER_SIZE);
     m_destructor = [] (void* p) { Gigacage::free(Gigacage::Primitive, p); };