160948 CVE-2016-4657 2016-08-17 14:17:20 -0700 Fixed a potential bug in MarkedArgumentBuffer 2017-10-11 10:22:57 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 ggaren ggaren bfulgham commit-queue keith_miller mark.lam msaboff oliver saam oldest_to_newest 1220957 0 ggaren 2016-08-17 14:17:20 -0700 Fixed a potential bug in MarkedArgumentBuffer 1220960 1 286329 ggaren 2016-08-17 14:22:45 -0700 Created attachment 286329 Patch 1220961 2 286329 oliver 2016-08-17 14:23:46 -0700 Comment on attachment 286329 Patch rs=me 1220962 3 ggaren 2016-08-17 14:24:22 -0700 Committed r204572: <http://trac.webkit.org/changeset/204572> 286329 2016-08-17 14:22:45 -0700 2016-08-17 14:23:46 -0700 Patch bug-160948-20160817142057.patch text/plain 4662 ggaren SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA0NTcwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDMxIEBA CisyMDE2LTA4LTE3ICBHZW9mZnJleSBHYXJlbiAgPGdnYXJlbkBhcHBsZS5jb20+CisKKyAgICAg ICAgRml4ZWQgYSBwb3RlbnRpYWwgYnVnIGluIE1hcmtlZEFyZ3VtZW50QnVmZmVyLgorICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTYwOTQ4CisgICAgICAg IDxyZGFyOi8vcHJvYmxlbS8yNzg4OTQxNj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBJIGhhdmVuJ3QgYmVlbiBhYmxlIHRvIHByb2R1Y2UgYW4gb2Jz ZXJ2YWJsZSB0ZXN0IGNhc2UgYWZ0ZXIgc29tZSB0cnlpbmcuCisKKyAgICAgICAgKiBydW50aW1l L0FyZ0xpc3QuY3BwOgorICAgICAgICAoSlNDOjpNYXJrZWRBcmd1bWVudEJ1ZmZlcjo6YWRkTWFy a1NldCk6IE5ldyBoZWxwZXIgZnVuY3Rpb24gLS0gSSBicm9rZQorICAgICAgICB0aGlzIG91dCBm cm9tIGV4aXN0aW5nIGNvZGUgZm9yIGNsYXJpdHksIGJ1dCB0aGUgYmVoYXZpb3IgaXMgdGhlIHNh bWUuCisKKyAgICAgICAgKEpTQzo6TWFya2VkQXJndW1lbnRCdWZmZXI6OmV4cGFuZENhcGFjaXR5 KTogRGl0dG8uCisKKyAgICAgICAgKEpTQzo6TWFya2VkQXJndW1lbnRCdWZmZXI6OnNsb3dBcHBl bmQpOiBBbHdheXMgYWRkTWFya1NldCgpIG9uIHRoZSBzbG93CisgICAgICAgIHBhdGguIFRoaXMg aXMgZmFzdGVyIHRoYW4gdGhlIG9sZCBsaW5lYXIgc2NhbiwgYW5kIEkgdGhpbmsgaXQgbWlnaHQK KyAgICAgICAgYXZvaWQgY2FzZXMgdGhlIG9sZCBzY2FuIGNvdWxkIG1pc3MuCisKKyAgICAgICAg KiBydW50aW1lL0FyZ0xpc3QuaDoKKyAgICAgICAgKEpTQzo6TWFya2VkQXJndW1lbnRCdWZmZXI6 OmFwcGVuZCk6IEFjY291bnQgZm9yIHRoZSBjYXNlIHdoZXJlIHNvbWVvbmUKKyAgICAgICAgaGFz IGNhbGxlZCBjbGVhcigpIG9yIHJlbW92ZUxhc3QoKS4KKworICAgICAgICAoSlNDOjpNYXJrZWRB cmd1bWVudEJ1ZmZlcjo6bWFsbG9jQmFzZSk6IE5vIGJlaGF2aW9yIGNoYW5nZSAtLSBidXQgaXQn cworICAgICAgICBjbGVhcmVyIHRvIHRlc3QgdGhlIGJ1ZmZlcnMgZGlyZWN0bHkgaW5zdGVhZCBv ZiBpbmZlcnJpbmcgd2hhdCB0aGV5CisgICAgICAgIG1pZ2h0IGJlIGJhc2VkIG9uIGNhcGFjaXR5 LgorCiAyMDE2LTA4LTE3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KIAogICAgICAg ICBSZW1vdmUgYW4gaW52YWxpZCBhc3NlcnRpb24gaW4gdGhlIERGRyBiYWNrZW5kJ3MgR2V0QnlJ ZCBlbWl0dGVyLgpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJnTGlzdC5j cHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJnTGlzdC5j cHAJKHJldmlzaW9uIDIwNDU3MCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0Fy Z0xpc3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zMCw2ICszMCwxOSBAQCB1c2luZyBzdGQ6Om1p bjsKIAogbmFtZXNwYWNlIEpTQyB7CiAKK3ZvaWQgTWFya2VkQXJndW1lbnRCdWZmZXI6OmFkZE1h cmtTZXQoSlNWYWx1ZSB2KQoreworICAgIGlmIChtX21hcmtTZXQpCisgICAgICAgIHJldHVybjsK KworICAgIEhlYXAqIGhlYXAgPSBIZWFwOjpoZWFwKHYpOworICAgIGlmICghaGVhcCkKKyAgICAg ICAgcmV0dXJuOworCisgICAgbV9tYXJrU2V0ID0gJmhlYXAtPm1hcmtMaXN0U2V0KCk7CisgICAg bV9tYXJrU2V0LT5hZGQodGhpcyk7Cit9CisKIHZvaWQgQXJnTGlzdDo6Z2V0U2xpY2UoaW50IHN0 YXJ0SW5kZXgsIEFyZ0xpc3QmIHJlc3VsdCkgY29uc3QKIHsKICAgICBpZiAoc3RhcnRJbmRleCA8 PSAwIHx8IHN0YXJ0SW5kZXggPj0gbV9hcmdDb3VudCkgewpAQCAtNTEsNDAgKzY0LDMxIEBAIHZv aWQgTWFya2VkQXJndW1lbnRCdWZmZXI6Om1hcmtMaXN0cyhIZWEKICAgICB9CiB9CiAKLXZvaWQg TWFya2VkQXJndW1lbnRCdWZmZXI6OnNsb3dBcHBlbmQoSlNWYWx1ZSB2KQordm9pZCBNYXJrZWRB cmd1bWVudEJ1ZmZlcjo6ZXhwYW5kQ2FwYWNpdHkoKQogewogICAgIGludCBuZXdDYXBhY2l0eSA9 IChDaGVja2VkPGludD4obV9jYXBhY2l0eSkgKiAyKS51bnNhZmVHZXQoKTsKICAgICBzaXplX3Qg c2l6ZSA9IChDaGVja2VkPHNpemVfdD4obmV3Q2FwYWNpdHkpICogc2l6ZW9mKEVuY29kZWRKU1Zh bHVlKSkudW5zYWZlR2V0KCk7CiAgICAgRW5jb2RlZEpTVmFsdWUqIG5ld0J1ZmZlciA9IHN0YXRp Y19jYXN0PEVuY29kZWRKU1ZhbHVlKj4oZmFzdE1hbGxvYyhzaXplKSk7Ci0gICAgZm9yIChpbnQg aSA9IDA7IGkgPCBtX2NhcGFjaXR5OyArK2kpCisgICAgZm9yIChpbnQgaSA9IDA7IGkgPCBtX2Nh cGFjaXR5OyArK2kpIHsKICAgICAgICAgbmV3QnVmZmVyW2ldID0gbV9idWZmZXJbaV07CisgICAg ICAgIGFkZE1hcmtTZXQoSlNWYWx1ZTo6ZGVjb2RlKG1fYnVmZmVyW2ldKSk7CisgICAgfQogCiAg ICAgaWYgKEVuY29kZWRKU1ZhbHVlKiBiYXNlID0gbWFsbG9jQmFzZSgpKQogICAgICAgICBmYXN0 RnJlZShiYXNlKTsKIAogICAgIG1fYnVmZmVyID0gbmV3QnVmZmVyOwogICAgIG1fY2FwYWNpdHkg PSBuZXdDYXBhY2l0eTsKK30KKwordm9pZCBNYXJrZWRBcmd1bWVudEJ1ZmZlcjo6c2xvd0FwcGVu ZChKU1ZhbHVlIHYpCit7CisgICAgaWYgKG1fc2l6ZSA+PSBtX2NhcGFjaXR5KQorICAgICAgICBl eHBhbmRDYXBhY2l0eSgpOwogCiAgICAgc2xvdEZvcihtX3NpemUpID0gSlNWYWx1ZTo6ZW5jb2Rl KHYpOwogICAgICsrbV9zaXplOwotCi0gICAgaWYgKG1fbWFya1NldCkKLSAgICAgICAgcmV0dXJu OwotCi0gICAgLy8gQXMgbG9uZyBhcyBvdXIgc2l6ZSBzdGF5cyB3aXRoaW4gb3VyIFZlY3Rvcidz IGlubGluZSAKLSAgICAvLyBjYXBhY2l0eSwgYWxsIG91ciB2YWx1ZXMgYXJlIGFsbG9jYXRlZCBv biB0aGUgc3RhY2ssIGFuZCAKLSAgICAvLyB0aGVyZWZvcmUgZG9uJ3QgbmVlZCBleHBsaWNpdCBt YXJraW5nLiBPbmNlIG91ciBzaXplIGV4Y2VlZHMKLSAgICAvLyBvdXIgVmVjdG9yJ3MgaW5saW5l IGNhcGFjaXR5LCB0aG91Z2gsIG91ciB2YWx1ZXMgbW92ZSB0byB0aGUgCi0gICAgLy8gaGVhcCwg d2hlcmUgdGhleSBkbyBuZWVkIGV4cGxpY2l0IG1hcmtpbmcuCi0gICAgZm9yIChpbnQgaSA9IDA7 IGkgPCBtX3NpemU7ICsraSkgewotICAgICAgICBIZWFwKiBoZWFwID0gSGVhcDo6aGVhcChKU1Zh bHVlOjpkZWNvZGUoc2xvdEZvcihpKSkpOwotICAgICAgICBpZiAoIWhlYXApCi0gICAgICAgICAg ICBjb250aW51ZTsKLQotICAgICAgICBtX21hcmtTZXQgPSAmaGVhcC0+bWFya0xpc3RTZXQoKTsK LSAgICAgICAgbV9tYXJrU2V0LT5hZGQodGhpcyk7Ci0gICAgICAgIGJyZWFrOwotICAgIH0KKyAg ICBhZGRNYXJrU2V0KHYpOwogfQogCiB9IC8vIG5hbWVzcGFjZSBKU0MKSW5kZXg6IFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9ydW50aW1lL0FyZ0xpc3QuaAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvcnVudGltZS9BcmdMaXN0LmgJKHJldmlzaW9uIDIwNDU3MCkKKysrIFNvdXJj ZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0FyZ0xpc3QuaAkod29ya2luZyBjb3B5KQpAQCAtNzcs NyArNzcsNyBAQCBwdWJsaWM6CiAKICAgICB2b2lkIGFwcGVuZChKU1ZhbHVlIHYpCiAgICAgewot ICAgICAgICBpZiAobV9zaXplID49IG1fY2FwYWNpdHkpCisgICAgICAgIGlmIChtX3NpemUgPj0g bV9jYXBhY2l0eSB8fCBtYWxsb2NCYXNlKCkpCiAgICAgICAgICAgICByZXR1cm4gc2xvd0FwcGVu ZCh2KTsKIAogICAgICAgICBzbG90Rm9yKG1fc2l6ZSkgPSBKU1ZhbHVlOjplbmNvZGUodik7CkBA IC05OSw2ICs5OSwxMCBAQCBwdWJsaWM6CiAgICAgc3RhdGljIHZvaWQgbWFya0xpc3RzKEhlYXBS b290VmlzaXRvciYsIExpc3RTZXQmKTsKIAogcHJpdmF0ZToKKyAgICB2b2lkIGV4cGFuZENhcGFj aXR5KCk7CisKKyAgICB2b2lkIGFkZE1hcmtTZXQoSlNWYWx1ZSk7CisKICAgICBKU19FWFBPUlRf UFJJVkFURSB2b2lkIHNsb3dBcHBlbmQoSlNWYWx1ZSk7CiAgICAgICAgIAogICAgIEVuY29kZWRK U1ZhbHVlJiBzbG90Rm9yKGludCBpdGVtKSBjb25zdApAQCAtMTA4LDcgKzExMiw3IEBAIHByaXZh dGU6CiAgICAgICAgIAogICAgIEVuY29kZWRKU1ZhbHVlKiBtYWxsb2NCYXNlKCkKICAgICB7Ci0g ICAgICAgIGlmIChtX2NhcGFjaXR5ID09IHN0YXRpY19jYXN0PGludD4oaW5saW5lQ2FwYWNpdHkp KQorICAgICAgICBpZiAobV9idWZmZXIgPT0gbV9pbmxpbmVCdWZmZXIpCiAgICAgICAgICAgICBy ZXR1cm4gMDsKICAgICAgICAgcmV0dXJuICZzbG90Rm9yKDApOwogICAgIH0K