Changeset 31309 in webkit


Ignore:
Timestamp:
Mar 25, 2008 11:46:54 PM (16 years ago)
Author:
Beth Dakin
Message:

WebCore:

2008-03-25 Beth Dakin <Beth Dakin>

Reviewed by Oliver.

Fix for <rdar://problem/5811826> CSSValueList::item() does not
range-check index

Check bounds before accessing the item to avoid a crash.
itemWithoutBoundsCheck() is still inlined and not bounds-checked to
avoid slowing down our internal callers of item().

  • css/CSSValueList.cpp: (WebCore::CSSValueList::item):
  • css/CSSValueList.h: (WebCore::CSSValueList::itemWithoutBoundsCheck):

Call itemWithoutBoundsCheck() to avoid slowing down these internal
callers.

  • css/CSSFontSelector.cpp: (WebCore::CSSFontSelector::addFontFaceRule):
  • css/CSSMutableStyleDeclaration.cpp: (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
  • css/CSSStyleSelector.cpp: (WebCore::applyCounterList): (WebCore::CSSStyleSelector::applyProperty):
  • css/MediaQueryEvaluator.cpp: (WebCore::parseAspectRatio):
  • svg/SVGFontFaceElement.cpp: (WebCore::SVGFontFaceElement::rebuildFontFace):
  • svg/graphics/SVGPaintServer.cpp: (WebCore::dashArrayFromRenderingStyle):

LayoutTests:

2008-03-25 Beth Dakin <Beth Dakin>

Reviewed by Oliver.

Test for <rdar://problem/5811826> CSSValueList::item() does not
range-check index

  • fast/css/resources/bikes.bmp: Added.
  • fast/css/value-list-out-of-bounds-crash.html: Added.
  • platform/mac/fast/css/value-list-out-of-bounds-crash-expected.checksum: Added.
  • platform/mac/fast/css/value-list-out-of-bounds-crash-expected.png: Added.
  • platform/mac/fast/css/value-list-out-of-bounds-crash-expected.txt: Added.
Location:
trunk
Files:
5 added
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r31303 r31309  
     12008-03-25  Beth Dakin  <bdakin@apple.com>
     2
     3        Reviewed by Oliver.
     4
     5        Test for <rdar://problem/5811826> CSSValueList::item() does not
     6        range-check index
     7
     8        * fast/css/resources/bikes.bmp: Added.
     9        * fast/css/value-list-out-of-bounds-crash.html: Added.
     10        * platform/mac/fast/css/value-list-out-of-bounds-crash-expected.checksum: Added.
     11        * platform/mac/fast/css/value-list-out-of-bounds-crash-expected.png: Added.
     12        * platform/mac/fast/css/value-list-out-of-bounds-crash-expected.txt: Added.
     13
    1142008-03-25  Darin Adler  <darin@apple.com>
    215

  • trunk/WebCore/ChangeLog

    r31307 r31309  
     12008-03-25  Beth Dakin  <bdakin@apple.com>
     2
     3        Reviewed by Oliver.
     4
     5        Fix for <rdar://problem/5811826> CSSValueList::item() does not
     6        range-check index
     7
     8        Check bounds before accessing the item to avoid a crash.
     9        itemWithoutBoundsCheck() is still inlined and not bounds-checked to
     10        avoid slowing down our internal callers of item().
     11        * css/CSSValueList.cpp:
     12        (WebCore::CSSValueList::item):
     13        * css/CSSValueList.h:
     14        (WebCore::CSSValueList::itemWithoutBoundsCheck):
     15
     16        Call itemWithoutBoundsCheck() to avoid slowing down these internal
     17        callers.
     18        * css/CSSFontSelector.cpp:
     19        (WebCore::CSSFontSelector::addFontFaceRule):
     20        * css/CSSMutableStyleDeclaration.cpp:
     21        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
     22        * css/CSSStyleSelector.cpp:
     23        (WebCore::applyCounterList):
     24        (WebCore::CSSStyleSelector::applyProperty):
     25        * css/MediaQueryEvaluator.cpp:
     26        (WebCore::parseAspectRatio):
     27        * svg/SVGFontFaceElement.cpp:
     28        (WebCore::SVGFontFaceElement::rebuildFontFace):
     29        * svg/graphics/SVGPaintServer.cpp:
     30        (WebCore::dashArrayFromRenderingStyle):
     31
    1322008-03-25  Antti Koivisto  <antti@apple.com>
    233

  • trunk/WebCore/css/CSSFontSelector.cpp

    r31290 r31309  
    146146    for (i = 0; i < srcLength; i++) {
    147147        // An item in the list either specifies a string (local font name) or a URL (remote font to download).
    148         CSSFontFaceSrcValue* item = static_cast<CSSFontFaceSrcValue*>(srcList->item(i));
     148        CSSFontFaceSrcValue* item = static_cast<CSSFontFaceSrcValue*>(srcList->itemWithoutBoundsCheck(i));
    149149        CSSFontFaceSource* source = 0;
    150150
    … …  
    204204    int familyLength = familyList->length();
    205205    for (i = 0; i < familyLength; i++) {
    206         CSSPrimitiveValue* item = static_cast<CSSPrimitiveValue*>(familyList->item(i));
     206        CSSPrimitiveValue* item = static_cast<CSSPrimitiveValue*>(familyList->itemWithoutBoundsCheck(i));
    207207        String familyName;
    208208        if (item->primitiveType() == CSSPrimitiveValue::CSS_STRING)
    … …  
    261261            unsigned numRanges = rangeList->length();
    262262            for (unsigned i = 0; i < numRanges; i++) {
    263                 CSSUnicodeRangeValue* range = static_cast<CSSUnicodeRangeValue*>(rangeList->item(i));
     263                CSSUnicodeRangeValue* range = static_cast<CSSUnicodeRangeValue*>(rangeList->itemWithoutBoundsCheck(i));
    264264                segmentedFontFace->overlayRange(range->from(), range->to(), fontFace);
    265265            }

  • trunk/WebCore/css/CSSMutableStyleDeclaration.cpp

    r31169 r31309  
    205205            if (values[j]) {
    206206                if (values[j]->isValueList())
    207                     value = static_cast<CSSValueList*>(values[j].get())->item(i);
     207                    value = static_cast<CSSValueList*>(values[j].get())->itemWithoutBoundsCheck(i);
    208208                else {
    209209                    value = values[j];

  • trunk/WebCore/css/CSSStyleSelector.cpp

    r31238 r31309  
    148148            prevChild->setNext(currChild); \
    149149        } \
    150         map##Prop(currChild, valueList->item(i)); \
     150        map##Prop(currChild, valueList->itemWithoutBoundsCheck(i)); \
    151151        prevChild = currChild; \
    152152        currChild = currChild->next(); \
    … …  
    22192219    int length = list ? list->length() : 0;
    22202220    for (int i = 0; i < length; ++i) {
    2221         Pair* pair = static_cast<CSSPrimitiveValue*>(list->item(i))->getPairValue();
     2221        Pair* pair = static_cast<CSSPrimitiveValue*>(list->itemWithoutBoundsCheck(i))->getPairValue();
    22222222        AtomicString identifier = static_cast<CSSPrimitiveValue*>(pair->first())->getStringValue();
    22232223        // FIXME: What about overflow?
    … …  
    26402640            m_style->setCursor(CURSOR_AUTO);
    26412641            for (int i = 0; i < len; i++) {
    2642                 CSSValue* item = list->item(i);
     2642                CSSValue* item = list->itemWithoutBoundsCheck(i);
    26432643                if (!item->isPrimitiveValue())
    26442644                    continue;
    … …  
    33593359        bool didSet = false;
    33603360        for (int i = 0; i < len; i++) {
    3361             CSSValue* item = list->item(i);
     3361            CSSValue* item = list->itemWithoutBoundsCheck(i);
    33623362            if (!item->isPrimitiveValue())
    33633363                continue;
    … …  
    34463446
    34473447        for (int i = 0; i < len; i++) {
    3448             CSSValue *item = list->item(i);
     3448            CSSValue *item = list->itemWithoutBoundsCheck(i);
    34493449            if (!item->isPrimitiveValue()) continue;
    34503450            CSSPrimitiveValue *val = static_cast<CSSPrimitiveValue*>(item);
    … …  
    35153515            for (int i = 0; i < len; i++)
    35163516            {
    3517                 CSSValue *item = list->item(i);
     3517                CSSValue *item = list->itemWithoutBoundsCheck(i);
    35183518                if (!item->isPrimitiveValue()) continue;
    35193519                primitiveValue = static_cast<CSSPrimitiveValue*>(item);
    … …  
    37793779        bool firstBinding = true;
    37803780        for (unsigned int i = 0; i < list->length(); i++) {
    3781             CSSValue *item = list->item(i);
     3781            CSSValue *item = list->itemWithoutBoundsCheck(i);
    37823782            CSSPrimitiveValue *val = static_cast<CSSPrimitiveValue*>(item);
    37833783            if (val->primitiveType() == CSSPrimitiveValue::CSS_URI) {
    … …  
    39483948        int len = list->length();
    39493949        for (int i = 0; i < len; i++) {
    3950             ShadowValue* item = static_cast<ShadowValue*>(list->item(i));
     3950            ShadowValue* item = static_cast<ShadowValue*>(list->itemWithoutBoundsCheck(i));
    39513951            int x = item->x->computeLengthInt(m_style, zoomFactor);
    39523952            int y = item->y->computeLengthInt(m_style, zoomFactor);
    … …  
    43554355            unsigned size = list->length();
    43564356            for (unsigned i = 0; i < size; i++) {
    4357                 CSSTransformValue* val = static_cast<CSSTransformValue*>(list->item(i));
     4357                CSSTransformValue* val = static_cast<CSSTransformValue*>(list->itemWithoutBoundsCheck(i));
    43584358                CSSValueList* values = val->values();
    43594359               
    4360                 CSSPrimitiveValue* firstValue = static_cast<CSSPrimitiveValue*>(values->item(0));
     4360                CSSPrimitiveValue* firstValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(0));
    43614361                 
    43624362                switch (val->type()) {
    … …  
    43724372                            if (val->type() == CSSTransformValue::ScaleTransformOperation) {
    43734373                                if (values->length() > 1) {
    4374                                     CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->item(1));
     4374                                    CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(1));
    43754375                                    sy = secondValue->getDoubleValue();
    43764376                                } else
    … …  
    43954395                            if (val->type() == CSSTransformValue::TranslateTransformOperation) {
    43964396                                if (values->length() > 1) {
    4397                                     CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->item(1));
     4397                                    CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(1));
    43984398                                    ty = convertToLength(secondValue, m_style, &ok);
    43994399                                } else
    … …  
    44324432                            if (val->type() == CSSTransformValue::SkewTransformOperation) {
    44334433                                if (values->length() > 1) {
    4434                                     CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->item(1));
     4434                                    CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(1));
    44354435                                    angleY = secondValue->getDoubleValue();
    44364436                                    if (secondValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
    … …  
    44484448                    }
    44494449                    case CSSTransformValue::MatrixTransformOperation: {
    4450                         CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->item(1));
    4451                         CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(values->item(2));
    4452                         CSSPrimitiveValue* fourthValue = static_cast<CSSPrimitiveValue*>(values->item(3));
    4453                         CSSPrimitiveValue* fifthValue = static_cast<CSSPrimitiveValue*>(values->item(4));
    4454                         CSSPrimitiveValue* sixthValue = static_cast<CSSPrimitiveValue*>(values->item(5));
     4450                        CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(1));
     4451                        CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(2));
     4452                        CSSPrimitiveValue* fourthValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(3));
     4453                        CSSPrimitiveValue* fifthValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(4));
     4454                        CSSPrimitiveValue* sixthValue = static_cast<CSSPrimitiveValue*>(values->itemWithoutBoundsCheck(5));
    44554455                        MatrixTransformOperation* matrix = new MatrixTransformOperation(firstValue->getDoubleValue(),
    44564456                                                                                        secondValue->getDoubleValue(),

  • trunk/WebCore/css/CSSValueList.cpp

    r25754 r31309  
    3636}
    3737
     38CSSValue* CSSValueList::item(unsigned index)
     39{
     40    if (index >= m_values.size())
     41        return 0;
     42    return m_values[index].get();
     43}
     44
    3845unsigned short CSSValueList::cssValueType() const
    3946{

  • trunk/WebCore/css/CSSValueList.h

    r25754 r31309  
    3636
    3737    unsigned length() const { return m_values.size(); }
    38     CSSValue* item (unsigned index) { return m_values[index].get(); }
     38    CSSValue* item(unsigned);
     39    CSSValue* itemWithoutBoundsCheck(unsigned index) { return m_values[index].get(); }
    3940
    4041    virtual bool isValueList() { return true; }

  • trunk/WebCore/css/MediaQueryEvaluator.cpp

    r30670 r31309  
    166166        CSSValueList* valueList = static_cast<CSSValueList*>(value);
    167167        if (valueList->length() == 3) {
    168             CSSValue* i0 = valueList->item(0);
    169             CSSValue* i1 = valueList->item(1);
    170             CSSValue* i2 = valueList->item(2);
     168            CSSValue* i0 = valueList->itemWithoutBoundsCheck(0);
     169            CSSValue* i1 = valueList->itemWithoutBoundsCheck(1);
     170            CSSValue* i2 = valueList->itemWithoutBoundsCheck(2);
    171171            if (i0->isPrimitiveValue() && static_cast<CSSPrimitiveValue*>(i0)->primitiveType() == CSSPrimitiveValue::CSS_NUMBER
    172172                && i1->isPrimitiveValue() && static_cast<CSSPrimitiveValue*>(i1)->primitiveType() == CSSPrimitiveValue::CSS_STRING

  • trunk/WebCore/svg/SVGFontFaceElement.cpp

    r31160 r31309  
    340340        unsigned srcLength = srcList ? srcList->length() : 0;
    341341        for (unsigned i = 0; i < srcLength; i++) {
    342             if (CSSFontFaceSrcValue* item = static_cast<CSSFontFaceSrcValue*>(srcList->item(i)))
     342            if (CSSFontFaceSrcValue* item = static_cast<CSSFontFaceSrcValue*>(srcList->itemWithoutBoundsCheck(i)))
    343343                item->setSVGFontFaceElement(this);
    344344        }

  • trunk/WebCore/svg/graphics/SVGPaintServer.cpp

    r30430 r31309  
    154154        unsigned long len = dashes->length();
    155155        for (unsigned long i = 0; i < len; i++) {
    156             dash = static_cast<CSSPrimitiveValue*>(dashes->item(i));
     156            dash = static_cast<CSSPrimitiveValue*>(dashes->itemWithoutBoundsCheck(i));
    157157            if (!dash)
    158158                continue;
Note: See TracChangeset for help on using the changeset viewer.