146652 2015-07-06 15:08:51 -0700 Memory corruption in WebGLRenderingContext::simulateVertexAttrib0 2015-07-07 01:26:25 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 dino dino commit-queue darin esprehn+autocc gyuyoung.kim kondapallykalyan roger_fong oldest_to_newest 1107236 0 dino 2015-07-06 15:08:51 -0700 Memory corruption in WebGLRenderingContext::simulateVertexAttrib0 1107238 1 dino 2015-07-06 15:11:47 -0700 <rdar://problem/21567767> 1107239 2 256244 dino 2015-07-06 15:12:26 -0700 Created attachment 256244 Patch 1107249 3 256244 bfulgham 2015-07-06 15:33:55 -0700 Comment on attachment 256244 Patch r=me 1107250 4 dino 2015-07-06 15:36:39 -0700 Committed r186380: <http://trac.webkit.org/changeset/186380> 1107351 5 256244 darin 2015-07-06 20:04:50 -0700 Comment on attachment 256244 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=256244&action=review > Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:4687 > + Checked<GC3Dsizeiptr, RecordOverflow> bufferDataSize = (numVertex + 1) * 4 * sizeof(GC3Dfloat); This doesn’t start using checked arithmetic until after doing all the math. Too late!!! 1107352 6 darin 2015-07-06 20:06:20 -0700 OK, seems like you fixed that in http://trac.webkit.org/changeset/186384 1107424 7 dino 2015-07-07 01:26:25 -0700 (In reply to comment #6) > OK, seems like you fixed that in http://trac.webkit.org/changeset/186384 Yeah. It was my mistake. I found it really hard to replicate the conditions that lead to this - things failed other verification steps first. So in the end I disabled the other checks and then stepped through in the debugger to exercise the new Checked stuff. 256244 2015-07-06 15:12:26 -0700 2015-07-06 15:33:55 -0700 Patch bug-146652-20150707081127.patch text/plain 3315 dino U3VidmVyc2lvbiBSZXZpc2lvbjogMTg2MzYzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzhjMjk5NGQyODE4MDdi OWJiNDIwMWJlYWM5ZjJhMDJhNjA0M2JiMy4uNzg5ZTJmOTE2ZGE2OWU2M2QyMzBhNjU3OThmYTA3 NzNiOTUxMTlmMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDE1LTA3LTA2ICBEZWFu IEphY2tzb24gIDxkaW5vQGFwcGxlLmNvbT4KKworICAgICAgICBNZW1vcnkgY29ycnVwdGlvbiBp biBXZWJHTFJlbmRlcmluZ0NvbnRleHQ6OnNpbXVsYXRlVmVydGV4QXR0cmliMAorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ2NjUyCisgICAgICAgIDxy ZGFyOi8vcHJvYmxlbS8yMTU2Nzc2Nz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBUaGUgZXhwcmVzc2lvbiAiKG51bVZlcnRleCArIDEpICogNCAqIHNp emVvZihHQzNEZmxvYXQpIiBjb3VsZCBwb3RlbnRpYWxseQorICAgICAgICBvdmVyZmxvdy4gTWFr ZSBpdCB1c2UgY2hlY2tlZCBhcml0aG1ldGljLgorCisgICAgICAgIEkgY291bGRuJ3QgbWFrZSBh IHRlc3QgY2FzZSB0aGF0IHJlbGlhYmx5IGV4ZXJjaXNlZCB0aGlzLgorCisgICAgICAgICogaHRt bC9jYW52YXMvV2ViR0xSZW5kZXJpbmdDb250ZXh0QmFzZS5jcHA6CisgICAgICAgIChXZWJDb3Jl OjpXZWJHTFJlbmRlcmluZ0NvbnRleHRCYXNlOjpzaW11bGF0ZVZlcnRleEF0dHJpYjApOiBVc2Vk IENoZWNrZWQ8R0MzRHNpemVpcHRyPgorICAgICAgICBmb3IgY2FsY3VsYXRpbmcgdGhlIHNpemUg b2YgdGhlIGJ1ZmZlci4KKwogMjAxNS0wNy0wNiAgRXJpYyBDYXJsc29uICA8ZXJpYy5jYXJsc29u QGFwcGxlLmNvbT4KIAogICAgICAgICBbTWFjXSBJbmFjdGl2ZSBBaXJQbGF5IHJvdXRlIHNob3Vs ZCBhdXRvbWF0aWNhbGx5IHRpbWVvdXQKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwv Y2FudmFzL1dlYkdMUmVuZGVyaW5nQ29udGV4dEJhc2UuY3BwIGIvU291cmNlL1dlYkNvcmUvaHRt bC9jYW52YXMvV2ViR0xSZW5kZXJpbmdDb250ZXh0QmFzZS5jcHAKaW5kZXggN2ExY2ZmM2YyODNh ODg4NmMxNzIzYWEwM2ZkZjk3MTkxY2VkZmU1OC4uNjM0MWUwZTg1MWMzNjg2MmZjMmJkYjM3MDgz NTQ2MmIzOWQxZTY5NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9jYW52YXMvV2Vi R0xSZW5kZXJpbmdDb250ZXh0QmFzZS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9jYW52 YXMvV2ViR0xSZW5kZXJpbmdDb250ZXh0QmFzZS5jcHAKQEAgLTg5LDYgKzg5LDcgQEAKICNpbmNs dWRlIDxydW50aW1lL0pTQ0lubGluZXMuaD4KICNpbmNsdWRlIDxydW50aW1lL1R5cGVkQXJyYXlJ bmxpbmVzLmg+CiAjaW5jbHVkZSA8cnVudGltZS9VaW50MzJBcnJheS5oPgorI2luY2x1ZGUgPHd0 Zi9DaGVja2VkQXJpdGhtZXRpYy5oPgogI2luY2x1ZGUgPHd0Zi9TdGRMaWJFeHRyYXMuaD4KICNp bmNsdWRlIDx3dGYvdGV4dC9DU3RyaW5nLmg+CiAjaW5jbHVkZSA8d3RmL3RleHQvU3RyaW5nQnVp bGRlci5oPgpAQCAtNDY4MywxMCArNDY4NCwxMiBAQCBib29sIFdlYkdMUmVuZGVyaW5nQ29udGV4 dEJhc2U6OnNpbXVsYXRlVmVydGV4QXR0cmliMChHQzNEc2l6ZWkgbnVtVmVydGV4KQogICAgICAg ICByZXR1cm4gZmFsc2U7CiAgICAgbV92ZXJ0ZXhBdHRyaWIwVXNlZEJlZm9yZSA9IHRydWU7CiAg ICAgbV9jb250ZXh0LT5iaW5kQnVmZmVyKEdyYXBoaWNzQ29udGV4dDNEOjpBUlJBWV9CVUZGRVIs IG1fdmVydGV4QXR0cmliMEJ1ZmZlci0+b2JqZWN0KCkpOwotICAgIEdDM0RzaXplaXB0ciBidWZm ZXJEYXRhU2l6ZSA9IChudW1WZXJ0ZXggKyAxKSAqIDQgKiBzaXplb2YoR0MzRGZsb2F0KTsKLSAg ICBpZiAoYnVmZmVyRGF0YVNpemUgPiBtX3ZlcnRleEF0dHJpYjBCdWZmZXJTaXplKSB7Ci0gICAg ICAgIG1fY29udGV4dC0+YnVmZmVyRGF0YShHcmFwaGljc0NvbnRleHQzRDo6QVJSQVlfQlVGRkVS LCBidWZmZXJEYXRhU2l6ZSwgMCwgR3JhcGhpY3NDb250ZXh0M0Q6OkRZTkFNSUNfRFJBVyk7Ci0g ICAgICAgIG1fdmVydGV4QXR0cmliMEJ1ZmZlclNpemUgPSBidWZmZXJEYXRhU2l6ZTsKKyAgICBD aGVja2VkPEdDM0RzaXplaXB0ciwgUmVjb3JkT3ZlcmZsb3c+IGJ1ZmZlckRhdGFTaXplID0gKG51 bVZlcnRleCArIDEpICogNCAqIHNpemVvZihHQzNEZmxvYXQpOworICAgIGlmIChidWZmZXJEYXRh U2l6ZS5oYXNPdmVyZmxvd2VkKCkpCisgICAgICAgIHJldHVybiBmYWxzZTsKKyAgICBpZiAoYnVm ZmVyRGF0YVNpemUudW5zYWZlR2V0KCkgPiBtX3ZlcnRleEF0dHJpYjBCdWZmZXJTaXplKSB7Cisg ICAgICAgIG1fY29udGV4dC0+YnVmZmVyRGF0YShHcmFwaGljc0NvbnRleHQzRDo6QVJSQVlfQlVG RkVSLCBidWZmZXJEYXRhU2l6ZS51bnNhZmVHZXQoKSwgMCwgR3JhcGhpY3NDb250ZXh0M0Q6OkRZ TkFNSUNfRFJBVyk7CisgICAgICAgIG1fdmVydGV4QXR0cmliMEJ1ZmZlclNpemUgPSBidWZmZXJE YXRhU2l6ZS51bnNhZmVHZXQoKTsKICAgICAgICAgbV9mb3JjZUF0dHJpYjBCdWZmZXJSZWZpbGwg PSB0cnVlOwogICAgIH0KICAgICBpZiAodXNpbmdWZXJ0ZXhBdHRyaWIwCkBAIC00NzA3LDcgKzQ3 MTAsNyBAQCBib29sIFdlYkdMUmVuZGVyaW5nQ29udGV4dEJhc2U6OnNpbXVsYXRlVmVydGV4QXR0 cmliMChHQzNEc2l6ZWkgbnVtVmVydGV4KQogICAgICAgICBtX3ZlcnRleEF0dHJpYjBCdWZmZXJW YWx1ZVsyXSA9IGF0dHJpYlZhbHVlLnZhbHVlWzJdOwogICAgICAgICBtX3ZlcnRleEF0dHJpYjBC dWZmZXJWYWx1ZVszXSA9IGF0dHJpYlZhbHVlLnZhbHVlWzNdOwogICAgICAgICBtX2ZvcmNlQXR0 cmliMEJ1ZmZlclJlZmlsbCA9IGZhbHNlOwotICAgICAgICBtX2NvbnRleHQtPmJ1ZmZlclN1YkRh dGEoR3JhcGhpY3NDb250ZXh0M0Q6OkFSUkFZX0JVRkZFUiwgMCwgYnVmZmVyRGF0YVNpemUsIGJ1 ZmZlckRhdGEuZ2V0KCkpOworICAgICAgICBtX2NvbnRleHQtPmJ1ZmZlclN1YkRhdGEoR3JhcGhp Y3NDb250ZXh0M0Q6OkFSUkFZX0JVRkZFUiwgMCwgYnVmZmVyRGF0YVNpemUudW5zYWZlR2V0KCks IGJ1ZmZlckRhdGEuZ2V0KCkpOwogICAgIH0KICAgICBtX2NvbnRleHQtPnZlcnRleEF0dHJpYlBv aW50ZXIoMCwgNCwgR3JhcGhpY3NDb250ZXh0M0Q6OkZMT0FULCAwLCAwLCAwKTsKICAgICByZXR1 cm4gdHJ1ZTsK