147619 2015-08-03 21:05:52 -0700 [WK2] Reserve Vector capacity in VectorArgumentCoder<false, T, inlineCapacity>::decode() 2015-08-08 14:32:37 -0700 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) Unspecified Unspecified RESOLVED INVALID P2 Normal --- 1 cdumez cdumez andersca benjamin commit-queue darin kling sam oldest_to_newest 1114509 0 cdumez 2015-08-03 21:05:52 -0700 Reserve Vector capacity in VectorArgumentCoder<false, T, inlineCapacity>::decode() as we know the size of the Vector in advance. 1114510 1 258152 cdumez 2015-08-03 21:06:50 -0700 Created attachment 258152 Patch 1114511 2 258152 kling 2015-08-03 21:13:33 -0700 Comment on attachment 258152 Patch r=me, so obvious! 1114516 3 258152 commit-queue 2015-08-03 22:02:03 -0700 Comment on attachment 258152 Patch Clearing flags on attachment: 258152 Committed r187812: <http://trac.webkit.org/changeset/187812> 1114517 4 commit-queue 2015-08-03 22:02:08 -0700 All reviewed patches have been landed. Closing bug. 1114626 5 andersca 2015-08-04 10:06:00 -0700 This is wrong. This means that a malicious web process could send a huge number and crash the UI process. Please revert this. 1114631 6 cdumez 2015-08-04 10:12:30 -0700 Reverted r187812 for reason: This is not safe Committed r187865: <http://trac.webkit.org/changeset/187865> 1116044 7 darin 2015-08-08 14:32:37 -0700 (In reply to comment #5) > This is wrong. This means that a malicious web process could send a huge > number and crash the UI process. Please revert this. Without this change, what happens if the web process sends a huge number for size? 258152 2015-08-03 21:06:50 -0700 2015-08-03 22:02:03 -0700 Patch bug-147619-20150803210642.patch text/plain 1699 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMTg3NzkzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXggYTJkMzU0YzY5NjIyZTk0 ZTE5YjdjNTY3NzA3MWEyYWFlZjc2NjQyMC4uMWFhNTQ3NDIxYzIxYmUxYWE3NWI2M2VjNDNlOTQ5 YTM4ZGIwZjIxYiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDE1LTA4LTAzICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgW1dLMl0gUmVzZXJ2ZSBWZWN0 b3IgY2FwYWNpdHkgaW4gVmVjdG9yQXJndW1lbnRDb2RlcjxmYWxzZSwgVCwgaW5saW5lQ2FwYWNp dHk+OjpkZWNvZGUoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTQ3NjE5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgUmVzZXJ2ZSBWZWN0b3IgY2FwYWNpdHkgaW4gVmVjdG9yQXJndW1lbnRDb2RlcjxmYWxz ZSwgVCwgaW5saW5lQ2FwYWNpdHk+OjpkZWNvZGUoKQorICAgICAgICBhcyB3ZSBrbm93IHRoZSBz aXplIG9mIHRoZSBWZWN0b3IgaW4gYWR2YW5jZS4KKworICAgICAgICAqIFBsYXRmb3JtL0lQQy9B cmd1bWVudENvZGVycy5oOgorCiAyMDE1LTA4LTAzICBNYXR0IFJhamNhICA8bXJhamNhQGFwcGxl LmNvbT4KIAogICAgICAgICBNZWRpYSBTZXNzaW9uOiBsZXQgVUkgY2xpZW50cyBxdWVyeSB3aGV0 aGVyIGEgbWVkaWEgZWxlbWVudCBpcyBwYXVzZWQKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQy L1BsYXRmb3JtL0lQQy9Bcmd1bWVudENvZGVycy5oIGIvU291cmNlL1dlYktpdDIvUGxhdGZvcm0v SVBDL0FyZ3VtZW50Q29kZXJzLmgKaW5kZXggOTgzODIwMjc1NzU2ZmEzMmI0YWEwZGZhNDczMGUy MDQ5NmZjZTJhNi4uZGU2NWZmMzVjN2U4NTdmM2UyZTk3Y2M1YTkzYzZiNWMxY2ZlYzk3ZSAxMDA2 NDQKLS0tIGEvU291cmNlL1dlYktpdDIvUGxhdGZvcm0vSVBDL0FyZ3VtZW50Q29kZXJzLmgKKysr IGIvU291cmNlL1dlYktpdDIvUGxhdGZvcm0vSVBDL0FyZ3VtZW50Q29kZXJzLmgKQEAgLTE2NCwx NSArMTY0LDE1IEBAIHRlbXBsYXRlPHR5cGVuYW1lIFQsIHNpemVfdCBpbmxpbmVDYXBhY2l0eT4g c3RydWN0IFZlY3RvckFyZ3VtZW50Q29kZXI8ZmFsc2UsIFQsCiAgICAgICAgICAgICByZXR1cm4g ZmFsc2U7CiAKICAgICAgICAgVmVjdG9yPFQsIGlubGluZUNhcGFjaXR5PiB0bXA7CisgICAgICAg IHRtcC5yZXNlcnZlSW5pdGlhbENhcGFjaXR5KHNpemUpOwogICAgICAgICBmb3IgKHNpemVfdCBp ID0gMDsgaSA8IHNpemU7ICsraSkgewogICAgICAgICAgICAgVCBlbGVtZW50OwogICAgICAgICAg ICAgaWYgKCFkZWNvZGVyLmRlY29kZShlbGVtZW50KSkKICAgICAgICAgICAgICAgICByZXR1cm4g ZmFsc2U7CiAgICAgICAgICAgICAKLSAgICAgICAgICAgIHRtcC5hcHBlbmQoV1RGOjptb3ZlKGVs ZW1lbnQpKTsKKyAgICAgICAgICAgIHRtcC51bmNoZWNrZWRBcHBlbmQoV1RGOjptb3ZlKGVsZW1l bnQpKTsKICAgICAgICAgfQogCi0gICAgICAgIHRtcC5zaHJpbmtUb0ZpdCgpOwogICAgICAgICB2 ZWN0b3Iuc3dhcCh0bXApOwogICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICB9Cg==