Changeset 65920 in webkit for trunk/JavaScriptCore/runtime/UString.cpp

Timestamp:

Aug 24, 2010, 12:00:56 PM (15 years ago)

Author:

[email protected]

Message:

2010-08-24 Oliver Hunt <​[email protected]>

Reviewed by Beth Dakin.

Make overflow guards in UString::utf8 explicit
​https://bugs.webkit.org/show_bug.cgi?id=44540

Add an explicit overflow check prior to allocating our buffer,
rather than implicitly relying on the guard in convertUTF16ToUTF8.

• runtime/UString.cpp: (JSC::UString::utf8):

File:

• trunk/JavaScriptCore/runtime/UString.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/UString.cpp

@@ -335 +335 @@
     //    have a good chance of being able to write the string into the
     //    buffer without reallocing (say, 1.5 x length).
+    if (length > numeric_limits<unsigned>::max() / 3)
+        return CString();
     Vector<char, 1024> bufferVector(length * 3);