Changeset 43962 in webkit for trunk/JavaScriptCore/runtime

Timestamp:

May 21, 2009, 1:41:29 AM (16 years ago)

Author:

[email protected]

Message:

2009-05-21 Cameron Zwarich <​[email protected]>

Reviewed by Maciej Stachowiak.

Bug 25912: Harden NumberPrototype.cpp by removing use of strcpy()
<​https://bugs.webkit.org/show_bug.cgi?id=25912>

This causes no change on SunSpider.

• runtime/NumberPrototype.cpp: (JSC::integerPartNoExp): replace strcpy() with memcpy(), ASSERT that the temporary buffer has sufficient space to store the result, and move the explicit null-termination closer to the memcpy() for easier visual inspection of the code. (JSC::fractionalPartToString): replace strcpy() with memcpy(), and ASSERT that the temporary buffer has sufficient space to store the result. There is no explicit null-termination because this is done by the caller. The same is already true for exponentialPartToString(). (JSC::numberProtoFuncToExponential): replace strcpy() with memcpy(), explicitly null-terminate the result, and ASSERT that the temporary buffer has sufficient space to store the result.

File:

• trunk/JavaScriptCore/runtime/NumberPrototype.cpp (modified) (3 diffs)

trunk/JavaScriptCore/runtime/NumberPrototype.cpp

@@ -83 +83 @@
 
         if (static_cast<int>(length) <= decimalPoint) {
-            strcpy(buf.data(), result);
+            ASSERT(decimalPoint < 1024);
+            memcpy(buf.data(), result, length);
             memset(buf.data() + length, '0', decimalPoint - length);
         } else
             strncpy(buf.data(), result, decimalPoint);
-
         buf[decimalPoint] = '\0';
+
         str.append(buf.data());
     }
@@ -278 +279 @@
             i += fractionalDigits;
         } else {
-            strcpy(buf + i, result + 1);
+            ASSERT(i + resultLength - 1 < 80);
+            memcpy(buf + i, result + 1, resultLength - 1);
             i += static_cast<int>(resultLength) - 1;
         }
@@ -355 +357 @@
         buf[i++] = '-';
 
-    if (decimalPoint == 999) // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
-        strcpy(buf + i, result);
-    else {
+    // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
+    if (decimalPoint == 999) {
+        ASSERT(i + resultLength < 80);
+        memcpy(buf + i, result, resultLength);
+        buf[i + resultLength] = '\0';
+    } else {
         buf[i++] = result[0];