Changeset 42644 in webkit for trunk/JavaScriptCore/runtime/UString.cpp

Timestamp:

Apr 18, 2009, 4:50:03 PM (16 years ago)

Author:

[email protected]

Message:

2009-04-18 Sam Weinig <​[email protected]>

Reviewed by Mark Rowe.

Fix for <rdar://problem/5861045>
A little bit of hardening for UString.

• runtime/UString.cpp: (JSC::concatenate): (JSC::UString::append):

File:

• trunk/JavaScriptCore/runtime/UString.cpp (modified) (9 diffs)

trunk/JavaScriptCore/runtime/UString.cpp

@@ -511 +511 @@
     } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), thisOffset + length))
+        int newCapacity = thisOffset + length;
+        if (newCapacity < thisOffset)
+            CRASH();
+        if (!expandCapacity(rep.get(), newCapacity))
             rep = &UString::Rep::null();
         if (rep->data()) {
@@ -520 +523 @@
     } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), thisOffset + length))
+        int newCapacity = thisOffset + length;
+        if (newCapacity < thisOffset)
+            CRASH();
+        if (!expandCapacity(rep.get(), newCapacity))
             rep = &UString::Rep::null();
         if (rep->data()) {
@@ -565 +571 @@
     } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), thisOffset + length);
+        int newCapacity = thisOffset + length;
+        if (newCapacity < thisOffset)
+            CRASH();
+        expandCapacity(rep.get(), newCapacity);
         UChar* d = rep->data();
         if (d) {
@@ -575 +584 @@
     } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
         // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), thisOffset + length);
+        int newCapacity = thisOffset + length;
+        if (newCapacity < thisOffset)
+            CRASH();
+        expandCapacity(rep.get(), newCapacity);
         UChar* d = rep->data();
         if (d) {
@@ -637 +649 @@
         //   string does more harm than good
         // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
+        
         UString x(a);
-        x.expandCapacity(aOffset + length);
+        int capacity = aOffset + length;
+        if (capacity < aOffset)
+            CRASH();
+        x.expandCapacity(capacity);
         if (!a->data() || !x.data())
             return 0;
@@ -988 +1004 @@
     } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length);
+        int newCapacity = thisOffset + length;
+        if (newCapacity < thisOffset)
+            CRASH();
+        expandCapacity(newCapacity);
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
@@ -996 +1015 @@
     } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(thisOffset + length);
+        int newCapacity = thisOffset + length;
+        if (newCapacity < thisOffset)
+            CRASH();
+        expandCapacity(newCapacity);
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
@@ -1055 +1077 @@
     } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length + 1);
+        int newCapacity = thisOffset + length + 1;
+        if (newCapacity < thisOffset)
+            CRASH();
+        expandCapacity(newCapacity);
         UChar* d = m_rep->data();
         if (d) {
@@ -1064 +1089 @@
     } else if (thisOffset + length == base->usedCapacity && length >= minShareSize) {
         // this reaches the end of the string - extend it and share
-        expandCapacity(thisOffset + length + 1);
+        int newCapacity = thisOffset + length + 1;
+        if (newCapacity < thisOffset)
+            CRASH();
+        expandCapacity(newCapacity);
         UChar* d = m_rep->data();
         if (d) {