Changeset 38315 in webkit

Timestamp:

Nov 11, 2008 2:13:59 PM (15 years ago)

Author:

ddkilzer@apple.com

Message:

2008-11-11 Aaron Golden <​agolden@apple.com>

Bug 22134: -[WebHistoryItem dictionaryRepresentation] accesses past the end of a vector

<​https://bugs.webkit.org/show_bug.cgi?id=22134>

Reviewed by Geoff Garen.

• History/WebHistoryItem.mm: (-[WebHistoryItem initFromDictionaryRepresentation:]): (-[WebHistoryItem dictionaryRepresentation]):

Location:

trunk/WebKit/mac

Files:

• ChangeLog (modified) (1 diff)
• History/WebHistoryItem.mm (modified) (2 diffs)

trunk/WebKit/mac/ChangeLog

@@ +1 @@
+2008-11-11  Aaron Golden  <agolden@apple.com>
+
+        Bug 22134: -[WebHistoryItem dictionaryRepresentation] accesses past the end of a vector
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22134>
+
+        Reviewed by Geoff Garen.
+
+        * History/WebHistoryItem.mm:
+        (-[WebHistoryItem initFromDictionaryRepresentation:]):
+        (-[WebHistoryItem dictionaryRepresentation]):
+
 2008-11-10  Anders Carlsson  <andersca@apple.com>
 

trunk/WebKit/mac/History/WebHistoryItem.mm

@@ -353 +353 @@
     NSArray *childDicts = [dict objectForKey:WebChildrenKey];
     if (childDicts) {
-        for (int i = [childDicts count]; i >= 0; i--) {
+        for (int i = [childDicts count] - 1; i >= 0; i--) {
             WebHistoryItem *child = [[WebHistoryItem alloc] initFromDictionaryRepresentation: [childDicts objectAtIndex:i]];
             core(_private)->addChildItem(core(child->_private));
@@ -411 +411 @@
         NSMutableArray *childDicts = [NSMutableArray arrayWithCapacity:children.size()];
         
-        for (int i = children.size(); i >= 0; i--)
+        for (int i = children.size() - 1; i >= 0; i--)
             [childDicts addObject:[kit(children[i].get()) dictionaryRepresentation]];
         [dict setObject: childDicts forKey:WebChildrenKey];