12559 2007-02-03 07:39:02 -0800 REGRESSION: Crash in checkForHeadCharset() under GuardMalloc 2007-02-03 12:24:27 -0800 1 1 1 Unclassified WebKit Page Loading 420+ Mac OS X 10.4 RESOLVED FIXED Regression P1 Critical --- 1 ap ap mitz mrowe oldest_to_newest 29012 0 ap 2007-02-03 07:39:02 -0800 run-webkit-tests fast/events/event-targets.html --guard-malloc This happens because the test for end of buffer is incorrect - it is not actually null terminated. Same problem is present elsewhere in this function, and I'm not sure if the code was buggy from the beginning, or some refactoring rendered it wrong. 29013 1 12900 ap 2007-02-03 07:47:05 -0800 Created attachment 12900 proposed fix 29017 2 sam 2007-02-03 08:24:21 -0800 Small style snafu, a double space snuck in between the < and the pEnd. - while (ptr != pEnd) { + while (ptr + 7 < pEnd) { // +7 guarantees that "<!--" and "<?xml" fit in the buffer - and certainly we aren't going to lose any "charset" that way. 29018 3 12900 darin 2007-02-03 12:04:38 -0800 Comment on attachment 12900 proposed fix r=me 29024 4 ap 2007-02-03 12:24:27 -0800 Committed revision 19387. 12900 2007-02-03 07:47:05 -0800 2007-02-03 12:04:38 -0800 proposed fix 12559r1_patch.txt text/plain 3784 ap SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAxOTM4NikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTYgQEAKKzIwMDctMDItMDMgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEB3ZWJr aXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNTU5CisgICAgICAgIFJF R1JFU1NJT046IENyYXNoIGluIGNoZWNrRm9ySGVhZENoYXJzZXQoKSB1bmRlciBHdWFyZE1hbGxv YworCisgICAgICAgIE5vIHRlc3RzIHBvc3NpYmxlLgorCisgICAgICAgICogbG9hZGVyL1RleHRS ZXNvdXJjZURlY29kZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6VGV4dFJlc291cmNlRGVjb2Rl cjo6Y2hlY2tGb3JIZWFkQ2hhcnNldCk6IEZpeCBlbmQgb2YgYnVmZmVyIGNoZWNrczsgc3ByaW5r bGUgYSBudW1iZXIgCisgICAgICAgIG9mIG5ldyBvbmUgb3ZlciB0aGUgZnVuY3Rpb24uCisKIDIw MDctMDItMDMgIERhdmlkIEtpbHplciAgPGRka2lsemVyQHdlYmtpdC5vcmc+CiAKICAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChuby1zdmcgYnVpbGQgZml4KS4KSW5kZXg6IFdlYkNvcmUvbG9h ZGVyL1RleHRSZXNvdXJjZURlY29kZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvbG9hZGVy L1RleHRSZXNvdXJjZURlY29kZXIuY3BwCShyZXZpc2lvbiAxOTM4NCkKKysrIFdlYkNvcmUvbG9h ZGVyL1RleHRSZXNvdXJjZURlY29kZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00OTEsNyArNDkx LDcgQEAgYm9vbCBUZXh0UmVzb3VyY2VEZWNvZGVyOjpjaGVja0ZvckhlYWRDaAogCiAgICAgY29u c3QgY2hhciogcHRyID0gbV9idWZmZXIuZGF0YSgpOwogICAgIGNvbnN0IGNoYXIqIHBFbmQgPSBw dHIgKyBtX2J1ZmZlci5zaXplKCk7Ci0gICAgd2hpbGUgKHB0ciAhPSBwRW5kKSB7CisgICAgd2hp bGUgKHB0ciArIDcgPCAgcEVuZCkgeyAvLyArNyBndWFyYW50ZWVzIHRoYXQgIjwhLS0iIGFuZCAi PD94bWwiIGZpdCBpbiB0aGUgYnVmZmVyIC0gYW5kIGNlcnRhaW5seSB3ZSBhcmVuJ3QgZ29pbmcg dG8gbG9zZSBhbnkgImNoYXJzZXQiIHRoYXQgd2F5LgogICAgICAgICBpZiAoKnB0ciA9PSAnPCcp IHsKICAgICAgICAgICAgIGJvb2wgZW5kID0gZmFsc2U7CiAgICAgICAgICAgICBwdHIrKzsKQEAg LTUwNiwxMiArNTA2LDEyIEBAIGJvb2wgVGV4dFJlc291cmNlRGVjb2Rlcjo6Y2hlY2tGb3JIZWFk Q2gKICAgICAgICAgICAgIC8vIEhhbmRsZSBYTUwgZGVjbGFyYXRpb24sIHdoaWNoIGNhbiBoYXZl IGVuY29kaW5nIGluIGl0LgogICAgICAgICAgICAgLy8gVGhpcyBlbmNvZGluZyBpcyBob25vcmVk IGV2ZW4gZm9yIEhUTUwgZG9jdW1lbnRzLgogICAgICAgICAgICAgaWYgKHB0clswXSA9PSAnPycg JiYgcHRyWzFdID09ICd4JyAmJiBwdHJbMl0gPT0gJ20nICYmIHB0clszXSA9PSAnbCcpIHsKLSAg ICAgICAgICAgICAgICBjb25zdCBjaGFyKiBlbmQgPSBwdHI7Ci0gICAgICAgICAgICAgICAgd2hp bGUgKCplbmQgIT0gJz4nICYmICplbmQgIT0gJ1wwJykKLSAgICAgICAgICAgICAgICAgICAgZW5k Kys7Ci0gICAgICAgICAgICAgICAgaWYgKCplbmQgPT0gJ1wwJykKLSAgICAgICAgICAgICAgICAg ICAgYnJlYWs7Ci0gICAgICAgICAgICAgICAgRGVwcmVjYXRlZENTdHJpbmcgc3RyKHB0ciwgZW5k IC0gcHRyKTsKKyAgICAgICAgICAgICAgICBjb25zdCBjaGFyKiB4bWxEZWNsYXJhdGlvbkVuZCA9 IHB0cjsKKyAgICAgICAgICAgICAgICB3aGlsZSAoeG1sRGVjbGFyYXRpb25FbmQgIT0gcEVuZCAm JiAqeG1sRGVjbGFyYXRpb25FbmQgIT0gJz4nKQorICAgICAgICAgICAgICAgICAgICArK3htbERl Y2xhcmF0aW9uRW5kOworICAgICAgICAgICAgICAgIGlmICh4bWxEZWNsYXJhdGlvbkVuZCA9PSBw RW5kKQorICAgICAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgICAgICAgICAgICAg RGVwcmVjYXRlZENTdHJpbmcgc3RyKHB0ciwgeG1sRGVjbGFyYXRpb25FbmQgLSBwdHIpOyAvLyBO byBuZWVkIGZvciArMSwgYmVjYXVzZSB3ZSBoYXZlIGFuIGV4dHJhICI/IiB0byBsb3NlIGF0IHRo ZSBlbmQgb2YgWE1MIGRlY2xhcmF0aW9uLgogICAgICAgICAgICAgICAgIGludCBsZW4gPSAwOwog ICAgICAgICAgICAgICAgIGludCBwb3MgPSBmaW5kWE1MRW5jb2Rpbmcoc3RyLCBsZW4pOwogICAg ICAgICAgICAgICAgIGlmIChwb3MgIT0gLTEpCkBAIC01NDAsNiArNTQwLDggQEAgYm9vbCBUZXh0 UmVzb3VyY2VEZWNvZGVyOjpjaGVja0ZvckhlYWRDaAogICAgICAgICAgICAgICAgICAoKnB0ciA+ PSAnMCcpICYmICgqcHRyIDw9ICc5JykpCiAgICAgICAgICAgICAgICAgJiYgbGVuIDwgMTkgKQog ICAgICAgICAgICAgeworICAgICAgICAgICAgICAgIGlmIChwdHIgPT0gcEVuZCkKKyAgICAgICAg ICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgICAgICAgICAgICAgIHRtcFtsZW5dID0gdG9s b3dlcigqcHRyKTsKICAgICAgICAgICAgICAgICBwdHIrKzsKICAgICAgICAgICAgICAgICBsZW4r KzsKQEAgLTU2MiwyMCArNTY0LDE5IEBAIGJvb2wgVGV4dFJlc291cmNlRGVjb2Rlcjo6Y2hlY2tG b3JIZWFkQ2gKICAgICAgICAgICAgIC8vIEZpbmQgd2hlcmUgdGhlIG9wZW5pbmcgdGFnIGVuZHMu CiAgICAgICAgICAgICBjb25zdCBjaGFyKiB0YWdDb250ZW50U3RhcnQgPSBwdHI7CiAgICAgICAg ICAgICBpZiAoIWVuZCkgewotICAgICAgICAgICAgICAgIHdoaWxlICgqcHRyICE9ICc+Jykgewot ICAgICAgICAgICAgICAgICAgICBpZiAoKnB0ciA9PSAnXDAnKQotICAgICAgICAgICAgICAgICAg ICAgICAgcmV0dXJuIGZhbHNlOworICAgICAgICAgICAgICAgIHdoaWxlIChwdHIgIT0gcEVuZCAm JiAqcHRyICE9ICc+JykgewogICAgICAgICAgICAgICAgICAgICBpZiAoKnB0ciA9PSAnXCcnIHx8 ICpwdHIgPT0gJyInKSB7CiAgICAgICAgICAgICAgICAgICAgICAgICBjaGFyIHF1b3RlTWFyayA9 ICpwdHI7CiAgICAgICAgICAgICAgICAgICAgICAgICArK3B0cjsKLSAgICAgICAgICAgICAgICAg ICAgICAgIHdoaWxlICgqcHRyICE9IHF1b3RlTWFyaykgewotICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGlmICgqcHRyID09ICdcMCcpCi0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHJldHVybiBmYWxzZTsKKyAgICAgICAgICAgICAgICAgICAgICAgIHdoaWxlIChwdHIgIT0gcEVu ZCAmJiAqcHRyICE9IHF1b3RlTWFyaykKICAgICAgICAgICAgICAgICAgICAgICAgICAgICArK3B0 cjsKLSAgICAgICAgICAgICAgICAgICAgICAgIH0KKyAgICAgICAgICAgICAgICAgICAgICAgIGlm IChwdHIgPT0gcEVuZCkKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7 CiAgICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgICAgICAgKytwdHI7CiAgICAg ICAgICAgICAgICAgfQorICAgICAgICAgICAgICAgIGlmIChwdHIgPT0gcEVuZCkKKyAgICAgICAg ICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgICAgICAgICAgICAgICsrcHRyOwogICAgICAg ICAgICAgfQogICAgICAgICAgICAgCg==