Changeset 42988 in webkit for trunk/JavaScriptCore/runtime/UString.cpp

Timestamp:

Apr 28, 2009, 10:56:18 PM (16 years ago)

Author:

[email protected]

Message:

A little more hardening for UString

Reviewed by Maciej Stachowiak.

Revised fix for <rdar://problem/5861045> in r42644.

• runtime/UString.cpp: (JSC::newCapacityWithOverflowCheck): Added. (JSC::concatenate): Used newCapacityWithOverflowCheck(). (JSC::UString::append): Ditto.

File:

• trunk/JavaScriptCore/runtime/UString.cpp (modified) (10 diffs)

trunk/JavaScriptCore/runtime/UString.cpp

@@ -492 +492 @@
 }
 
+static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
+{
+    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
+
+    const int plusLength = plusOne ? 1 : 0;
+    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
+        CRASH();
+
+    return currentCapacity + extendLength + plusLength;
+}
+
 static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
 {
@@ -511 +522 @@
     } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        int newCapacity = thisOffset + length;
-        if (newCapacity < thisOffset)
-            CRASH();
-        if (!expandCapacity(rep.get(), newCapacity))
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
             rep = &UString::Rep::null();
         if (rep->data()) {
@@ -523 +531 @@
     } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        int newCapacity = thisOffset + length;
-        if (newCapacity < thisOffset)
-            CRASH();
-        if (!expandCapacity(rep.get(), newCapacity))
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
             rep = &UString::Rep::null();
         if (rep->data()) {
@@ -571 +576 @@
     } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        int newCapacity = thisOffset + length;
-        if (newCapacity < thisOffset)
-            CRASH();
-        expandCapacity(rep.get(), newCapacity);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
@@ -584 +586 @@
     } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
         // this string reaches the end of the buffer - extend it
-        int newCapacity = thisOffset + length;
-        if (newCapacity < thisOffset)
-            CRASH();
-        expandCapacity(rep.get(), newCapacity);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
@@ -651 +650 @@
         
         UString x(a);
-        int capacity = aOffset + length;
-        if (capacity < aOffset)
-            CRASH();
-        x.expandCapacity(capacity);
+        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
         if (!a->data() || !x.data())
             return 0;
@@ -1004 +1000 @@
     } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        int newCapacity = thisOffset + length;
-        if (newCapacity < thisOffset)
-            CRASH();
-        expandCapacity(newCapacity);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
@@ -1015 +1008 @@
     } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        int newCapacity = thisOffset + length;
-        if (newCapacity < thisOffset)
-            CRASH();
-        expandCapacity(newCapacity);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
@@ -1077 +1067 @@
     } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        int newCapacity = thisOffset + length + 1;
-        if (newCapacity < thisOffset)
-            CRASH();
-        expandCapacity(newCapacity);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {
@@ -1089 +1076 @@
     } else if (thisOffset + length == base->usedCapacity && length >= minShareSize) {
         // this reaches the end of the string - extend it and share
-        int newCapacity = thisOffset + length + 1;
-        if (newCapacity < thisOffset)
-            CRASH();
-        expandCapacity(newCapacity);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {