Changeset 42659 in webkit for trunk/JavaScriptCore/API

Timestamp:

Apr 19, 2009, 3:26:00 PM (16 years ago)

Author:

[email protected]

Message:

2009-04-19 Sam Weinig <​[email protected]>

Reviewed by Dan Bernstein.

Fix for <rdar://problem/5860954>
Harden JSStringCreateWithCFString against malformed CFStringRefs.

• API/JSStringRefCF.cpp: (JSStringCreateWithCFString):

File:

• trunk/JavaScriptCore/API/JSStringRefCF.cpp (modified) (1 diff)

trunk/JavaScriptCore/API/JSStringRefCF.cpp

@@ -39 +39 @@
     JSC::initializeThreading();
     CFIndex length = CFStringGetLength(string);
+    if (length < 0)
+        CRASH():
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);