Changeset 69682 in webkit

Timestamp:

Oct 13, 2010 12:21:48 PM (14 years ago)

Author:

commit-queue@webkit.org

Message:

2010-10-13 Yong Li <​yoli@rim.com>

Reviewed by Oliver Hunt.

Fix potential misaligned memory access in CloneDeserializer::readLittleEndian and readString
that can result crash on ARM (<v6).
​https://bugs.webkit.org/show_bug.cgi?id=47594

No new test added, because the crash can be produced by existing tests like:
LayoutTests/fast/events/message-channel-gc-4.html

• bindings/js/SerializedScriptValue.cpp: (WebCore::CloneDeserializer::readLittleEndian): (WebCore::CloneDeserializer::readString):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/SerializedScriptValue.cpp (modified) (2 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-10-13  Yong Li  <yoli@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix potential misaligned memory access in CloneDeserializer::readLittleEndian and readString
+        that can result crash on ARM (<v6).
+        https://bugs.webkit.org/show_bug.cgi?id=47594
+
+        No new test added, because the crash can be produced by existing tests like:
+        LayoutTests/fast/events/message-channel-gc-4.html
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readLittleEndian):
+        (WebCore::CloneDeserializer::readString):
+
 2010-10-06  Martin Robinson  <mrobinson@igalia.com>
 

trunk/WebCore/bindings/js/SerializedScriptValue.cpp

@@ -820 +820 @@
             value = *ptr++;
         else {
-            value = *reinterpret_cast_ptr<const T*>(ptr);
+#if CPU(ARMV5_OR_LOWER)
+            // To protect misaligned memory access.
+            memcpy(&value, ptr, sizeof(T));
+#else
+            value = *reinterpret_cast<const T*>(ptr);
+#endif
             ptr += sizeof(T);
         }
@@ -908 +913 @@
 
 #if ASSUME_LITTLE_ENDIAN
-        str = UString(reinterpret_cast_ptr<const UChar*>(ptr), length);
+#if CPU(ARMV5_OR_LOWER)
+        // To protect misaligned memory access.
+        Vector<UChar> alignedBuffer(length);
+        memcpy(alignedBuffer.data(), ptr, length * sizeof(UChar));
+        str = UString::adopt(alignedBuffer);
+#else
+        str = UString(reinterpret_cast<const UChar*>(ptr), length);
+#endif
         ptr += length * sizeof(UChar);
 #else