Changeset 66119 in webkit for trunk/JavaScriptCore/wtf/text/StringImpl.cpp

Timestamp:

Aug 26, 2010, 12:00:53 PM (15 years ago)

Author:

[email protected]

Message:

2010-08-25 Oliver Hunt <​[email protected]>

Reviewed by Geoffrey Garen.

Improve overflow handling in StringImpl::Replace
​https://bugs.webkit.org/show_bug.cgi?id=42502
<rdar://problem/8203794>

Harden StringImpl::replace against overflow -- I can't see how this
could be abused, but it's better to be safe than sorry.

• wtf/text/StringImpl.cpp: (WTF::StringImpl::replace):

File:

• trunk/JavaScriptCore/wtf/text/StringImpl.cpp (modified) (4 diffs)

trunk/JavaScriptCore/wtf/text/StringImpl.cpp

@@ -32 +32 @@
 #include <wtf/WTFThreadData.h>
 
+using namespace std;
+
 namespace WTF {
 
@@ -777 +779 @@
         return this;
     UChar* data;
+
+    if ((length() - lengthToReplace) >= (numeric_limits<unsigned>::max() - lengthToInsert))
+        CRASH();
+
     PassRefPtr<StringImpl> newImpl =
         createUninitialized(length() - lengthToReplace + lengthToInsert, data);
@@ -806 +812 @@
         return this;
     
+    if (repStrLength && matchCount > numeric_limits<unsigned>::max() / repStrLength)
+        CRASH();
+
+    unsigned replaceSize = matchCount * repStrLength;
+    unsigned newSize = m_length - matchCount;
+    if (newSize >= (numeric_limits<unsigned>::max() - replaceSize))
+        CRASH();
+
+    newSize += replaceSize;
+
     UChar* data;
-    PassRefPtr<StringImpl> newImpl =
-        createUninitialized(m_length - matchCount + (matchCount * repStrLength), data);
+    PassRefPtr<StringImpl> newImpl = createUninitialized(newSize, data);
 
     // Construct the new data
@@ -856 +871 @@
         return this;
     
+    unsigned newSize = m_length - matchCount * patternLength;
+    if (repStrLength && matchCount > numeric_limits<unsigned>::max() / repStrLength)
+        CRASH();
+
+    if (newSize > (numeric_limits<unsigned>::max() - matchCount * repStrLength))
+        CRASH();
+
+    newSize += matchCount * repStrLength;
+
     UChar* data;
-    PassRefPtr<StringImpl> newImpl =
-        createUninitialized(m_length + matchCount * (repStrLength - patternLength), data);
+    PassRefPtr<StringImpl> newImpl = createUninitialized(newSize, data);
     
     // Construct the new data