Changeset 203299 in webkit for trunk/Source/JavaScriptCore/tools/FunctionOverrides.cpp

Timestamp:

Jul 15, 2016, 2:17:01 PM (9 years ago)

Author:

[email protected]

Message:

FunctionOverride's parseClause() needs to keep the CString instance in scope while its data is being used.
​https://bugs.webkit.org/show_bug.cgi?id=159828

Reviewed by Saam Barati.

Otherwise, we'll have a use after free. This issue was caught when running an
ASan debug build of testapi.

• tools/FunctionOverrides.cpp:

(JSC::parseClause):

File:

• trunk/Source/JavaScriptCore/tools/FunctionOverrides.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/tools/FunctionOverrides.cpp

@@ -206 +206 @@
     terminatorString.append(delimiter);
 
-    const char* terminator = terminatorString.ascii().data();
+    CString terminatorCString = terminatorString.ascii();
+    const char* terminator = terminatorCString.data();
     line = delimiterEnd; // Start from the {.