Changeset 42662 in webkit

Timestamp:

Apr 19, 2009 3:54:39 PM (15 years ago)

Author:

weinig@apple.com

Message:

2009-04-19 Sam Weinig <​sam@webkit.org>

Reviewed by Darin Adler.

Better fix for JSStringCreateWithCFString hardening.

• API/JSStringRefCF.cpp: (JSStringCreateWithCFString):

Location:

trunk/JavaScriptCore

Files:

• API/JSStringRefCF.cpp (modified) (1 diff)
• ChangeLog (modified) (1 diff)

trunk/JavaScriptCore/API/JSStringRefCF.cpp

@@ -38 +38 @@
 {
     JSC::initializeThreading();
-    CFIndex length = CFStringGetLength(string);
-    if (length < 0)
-        CRASH():
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Better fix for JSStringCreateWithCFString hardening.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
 2009-04-19  Sam Weinig  <sam@webkit.org>