Changeset 42662 in webkit for trunk/JavaScriptCore/API/JSStringRefCF.cpp

Timestamp:

Apr 19, 2009, 3:54:39 PM (16 years ago)

Author:

[email protected]

Message:

2009-04-19 Sam Weinig <​[email protected]>

Reviewed by Darin Adler.

Better fix for JSStringCreateWithCFString hardening.

• API/JSStringRefCF.cpp: (JSStringCreateWithCFString):

File:

• trunk/JavaScriptCore/API/JSStringRefCF.cpp (modified) (1 diff)

trunk/JavaScriptCore/API/JSStringRefCF.cpp

@@ -38 +38 @@
 {
     JSC::initializeThreading();
-    CFIndex length = CFStringGetLength(string);
-    if (length < 0)
-        CRASH():
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);