140376 2015-01-12 16:54:56 -0800 Out of bounds read in IdentifierArena::makeIdentifier 2015-12-08 14:22:02 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ggaren ggaren ap bfulgham oldest_to_newest 1060721 0 ggaren 2015-01-12 16:54:56 -0800 Out of bounds read in IdentifierArena::makeIdentifier 1060722 1 ggaren 2015-01-12 16:55:54 -0800 Alexey says: IdentifierArena::makeIdentifier is sometimes called with an empty string, in which case it creates the identifier from garbage memory. Steps to reproduce: 1. Add ASSERT(length > 0); to IdentifierArena::makeIdentifier. 2. Open https://bugs.webkit.org/enter_bug.cgi?product=WebKit Results: the assertion fails. This out of bounds read is not harmless, because the value affects logic in this function, and then goes into an actual identifier. IdentifierArena::makeIdentifierLCharFromUChar has the same problem. 1060723 2 ggaren 2015-01-12 16:58:27 -0800 <rdar://problem/19437703> 1060724 3 244479 ggaren 2015-01-12 17:00:41 -0800 Created attachment 244479 Patch 1060725 4 244479 ggaren 2015-01-12 17:03:03 -0800 Comment on attachment 244479 Patch Alexey wrote and tested this patch. I tested it some more, and reviewed it. 1060727 5 ggaren 2015-01-12 17:04:34 -0800 Committed r178311: <http://trac.webkit.org/changeset/178311> 244479 2015-01-12 17:00:41 -0800 2015-01-12 17:03:03 -0800 Patch bug-140376-20150112170045.patch text/plain 2438 ggaren SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc4MzEwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBA CisyMDE1LTAxLTEyICBHZW9mZnJleSBHYXJlbiAgPGdnYXJlbkBhcHBsZS5jb20+CisKKyAgICAg ICAgT3V0IG9mIGJvdW5kcyByZWFkIGluIElkZW50aWZpZXJBcmVuYTo6bWFrZUlkZW50aWZpZXIK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MDM3Ngor CisgICAgICAgIFJldmlld2VkIGJ5IEFsZXhleSBQcm9za3VyeWFrb3YgLS0gb3IgbWF5YmUgdGhl IG90aGVyIHdheSBhcm91bmQuCisKKyAgICAgICAgTm8gdGVzdCwgc2luY2UgdGhpcyBpcyBhIHNt YWxsIHBhc3QtdGhlLWVuZCByZWFkLCB3aGljaCBpcyB2ZXJ5CisgICAgICAgIGRpZmZpY3VsdCB0 byB0dXJuIGludG8gYSByZXByb2R1Y2libGUgZmFpbGluZyB0ZXN0IC0tIGFuZCBleGlzdGluZyB0 ZXN0cworICAgICAgICBjcmFzaCByZWxpYWJseSB1c2luZyBBU2FuLgorCisgICAgICAgICogcGFy c2VyL1BhcnNlckFyZW5hLmg6CisgICAgICAgIChKU0M6OklkZW50aWZpZXJBcmVuYTo6bWFrZUlk ZW50aWZpZXIpOgorICAgICAgICAoSlNDOjpJZGVudGlmaWVyQXJlbmE6Om1ha2VJZGVudGlmaWVy TENoYXJGcm9tVUNoYXIpOiBDaGVjayBmb3IgYQorICAgICAgICB6ZXJvLWxlbmd0aCBzdHJpbmcg aW5wdXQsIGxpa2Ugd2UgZG8gaW4gdGhlIGxpdGVyYWwgcGFyc2VyLCBzaW5jZSBpdCBpcworICAg ICAgICBub3QgdmFsaWQgdG8gZGVyZWZlcmVuY2UgY2hhcmFjdGVycyBpbiBhIHplcm8tbGVuZ3Ro IHN0cmluZy4KKworICAgICAgICBBIHplcm8tbGVuZ3RoIHN0cmluZyBpcyBhbGxvd2VkIGluIEph dmFTY3JpcHQgLS0gZm9yIGV4YW1wbGUsICIiLgorCiAyMDE1LTAxLTExICBTYW0gV2VpbmlnICA8 c2FtQHdlYmtpdC5vcmc+CiAKICAgICAgICAgUmVtb3ZlIHN1cHBvcnQgZm9yIFNoYXJlZFdvcmtl cnMKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9wYXJzZXIvUGFyc2VyQXJlbmEuaAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcGFyc2VyL1BhcnNlckFyZW5hLmgJKHJl dmlzaW9uIDE3ODMwNCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9wYXJzZXIvUGFyc2VyQXJl bmEuaAkod29ya2luZyBjb3B5KQpAQCAtMjYsNiArMjYsNyBAQAogI2lmbmRlZiBQYXJzZXJBcmVu YV9oCiAjZGVmaW5lIFBhcnNlckFyZW5hX2gKIAorI2luY2x1ZGUgIkNvbW1vbklkZW50aWZpZXJz LmgiCiAjaW5jbHVkZSAiSWRlbnRpZmllci5oIgogI2luY2x1ZGUgPGFycmF5PgogI2luY2x1ZGUg PHd0Zi9TZWdtZW50ZWRWZWN0b3IuaD4KQEAgLTY5LDYgKzcwLDggQEAgbmFtZXNwYWNlIEpTQyB7 CiAgICAgdGVtcGxhdGUgPHR5cGVuYW1lIFQ+CiAgICAgQUxXQVlTX0lOTElORSBjb25zdCBJZGVu dGlmaWVyJiBJZGVudGlmaWVyQXJlbmE6Om1ha2VJZGVudGlmaWVyKFZNKiB2bSwgY29uc3QgVCog Y2hhcmFjdGVycywgc2l6ZV90IGxlbmd0aCkKICAgICB7CisgICAgICAgIGlmICghbGVuZ3RoKQor ICAgICAgICAgICAgcmV0dXJuIHZtLT5wcm9wZXJ0eU5hbWVzLT5lbXB0eUlkZW50aWZpZXI7CiAg ICAgICAgIGlmIChjaGFyYWN0ZXJzWzBdID49IE1heGltdW1DYWNoYWJsZUNoYXJhY3Rlcikgewog ICAgICAgICAgICAgbV9pZGVudGlmaWVycy5hcHBlbmQoSWRlbnRpZmllcih2bSwgY2hhcmFjdGVy cywgbGVuZ3RoKSk7CiAgICAgICAgICAgICByZXR1cm4gbV9pZGVudGlmaWVycy5sYXN0KCk7CkBA IC05MCw2ICs5Myw4IEBAIG5hbWVzcGFjZSBKU0MgewogCiAgICAgQUxXQVlTX0lOTElORSBjb25z dCBJZGVudGlmaWVyJiBJZGVudGlmaWVyQXJlbmE6Om1ha2VJZGVudGlmaWVyTENoYXJGcm9tVUNo YXIoVk0qIHZtLCBjb25zdCBVQ2hhciogY2hhcmFjdGVycywgc2l6ZV90IGxlbmd0aCkKICAgICB7 CisgICAgICAgIGlmICghbGVuZ3RoKQorICAgICAgICAgICAgcmV0dXJuIHZtLT5wcm9wZXJ0eU5h bWVzLT5lbXB0eUlkZW50aWZpZXI7CiAgICAgICAgIGlmIChjaGFyYWN0ZXJzWzBdID49IE1heGlt dW1DYWNoYWJsZUNoYXJhY3RlcikgewogICAgICAgICAgICAgbV9pZGVudGlmaWVycy5hcHBlbmQo SWRlbnRpZmllcjo6Y3JlYXRlTENoYXJGcm9tVUNoYXIodm0sIGNoYXJhY3RlcnMsIGxlbmd0aCkp OwogICAgICAgICAgICAgcmV0dXJuIG1faWRlbnRpZmllcnMubGFzdCgpOwo=