166622 2016-12-30 07:31:51 -0800 [EFL] fix buffer over-read in RenderThemeEfl::mediaControlsStyleSheet() 2016-12-30 08:17:29 -0800 1 1 1 Unclassified WebKit WebKit EFL Other Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 olivier.blin webkit-unassigned benjamin commit-queue darin esprehn+autocc glenn gyuyoung.kim kondapallykalyan lucas.de.marchi magomez mcatanzaro zan oldest_to_newest 1263156 0 olivier.blin 2016-12-30 07:31:51 -0800 This has been detected by a charactersAreAllASCII() assert failure. Initially in WebKitForWayland (WPE), but the code was likely borrowed from EFL. This is because ASCIILiteral() is wrongly used in mediaControlsStyleSheet(). mediaControlsBaseUserAgentStyleSheet is a char array, not a null-terminated string. It is thus incorrect to use StringImpl::createFromLiteral() that calls strlen() to get the string length. The String::ConstructFromLiteral constructor can not be used, since it skips the last character. The size should be explicitly passed to the String constructor. 1263157 1 297858 olivier.blin 2016-12-30 07:36:57 -0800 Created attachment 297858 Patch 1263158 2 297858 gyuyoung.kim 2016-12-30 07:41:53 -0800 Comment on attachment 297858 Patch LGTM based on GTK port implementation. 1263159 3 297858 commit-queue 2016-12-30 08:17:23 -0800 Comment on attachment 297858 Patch Clearing flags on attachment: 297858 Committed r210213: <http://trac.webkit.org/changeset/210213> 1263160 4 commit-queue 2016-12-30 08:17:29 -0800 All reviewed patches have been landed. Closing bug. 297858 2016-12-30 07:36:57 -0800 2016-12-30 08:17:23 -0800 Patch bug-166622-20161230163539.patch text/plain 2061 olivier.blin U3VidmVyc2lvbiBSZXZpc2lvbjogMjEwMTk3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzgzNzQzZWVkYTgyNTNk NDZiNzg2MDk0YzdjNTFkZTgyNTQxNTc1Yy4uMDgzYjM2M2UyODU0YjE3MTFhZjA5ZDE5MzRiMTE5 MzZkZTU2MGJjYiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI1IEBACisyMDE2LTEyLTMwICBPbGl2 aWVyIEJsaW4gIDxvbGl2aWVyLmJsaW5Ac29mdGF0aG9tZS5jb20+CisKKyAgICAgICAgW0VGTF0g Zml4IGJ1ZmZlciBvdmVyLXJlYWQgaW4gUmVuZGVyVGhlbWVFZmw6Om1lZGlhQ29udHJvbHNTdHls ZVNoZWV0KCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTE2NjYyMgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IFRoaXMgaGFzIGJlZW4gZGV0ZWN0ZWQgYnkgYSBjaGFyYWN0ZXJzQXJlQWxsQVNDSUkoKSBhc3Nl cnQgZmFpbHVyZS4KKyAgICAgICAgSW5pdGlhbGx5IGluIFdlYktpdEZvcldheWxhbmQgKFdQRSks IGJ1dCB0aGUgY29kZSB3YXMgbGlrZWx5IGJvcnJvd2VkIGZyb20gRUZMLgorCisgICAgICAgIFRo aXMgaXMgYmVjYXVzZSBBU0NJSUxpdGVyYWwoKSBpcyB3cm9uZ2x5IHVzZWQgaW4gbWVkaWFDb250 cm9sc1N0eWxlU2hlZXQoKS4KKyAgICAgICAgbWVkaWFDb250cm9sc0Jhc2VVc2VyQWdlbnRTdHls ZVNoZWV0IGlzIGEgY2hhciBhcnJheSwgbm90IGEgbnVsbC10ZXJtaW5hdGVkIHN0cmluZy4KKyAg ICAgICAgSXQgaXMgdGh1cyBpbmNvcnJlY3QgdG8gdXNlIFN0cmluZ0ltcGw6OmNyZWF0ZUZyb21M aXRlcmFsKCkgdGhhdCBjYWxscworICAgICAgICBzdHJsZW4oKSB0byBnZXQgdGhlIHN0cmluZyBs ZW5ndGguCisKKyAgICAgICAgVGhlIFN0cmluZzo6Q29uc3RydWN0RnJvbUxpdGVyYWwgY29uc3Ry dWN0b3IgY2FuIG5vdCBiZSB1c2VkLCBzaW5jZSBpdAorICAgICAgICBza2lwcyB0aGUgbGFzdCBj aGFyYWN0ZXIuCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyVGhlbWVFZmwuY3BwOgorICAg ICAgICAoV2ViQ29yZTo6UmVuZGVyVGhlbWVFZmw6Om1lZGlhQ29udHJvbHNTdHlsZVNoZWV0KToK KyAgICAgICAgRXhwbGljaXRlbHkgcGFzcyB0aGUgc2l6ZSB0byB0aGUgU3RyaW5nIGNvbnN0cnVj dG9yLgorCiAyMDE2LTEyLTA5ICBTZXJnaW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEu Y29tPgogCiAgICAgICAgIFtjc3MtZ3JpZF0gTW92ZSBHcmlkIGludG8gR3JpZFNpemluZ0RhdGEK ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJUaGVtZUVmbC5jcHAg Yi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyVGhlbWVFZmwuY3BwCmluZGV4IDlhZGQ0 NmQ3MTFjYjdjZTY2MjE0ZWNiMTA4ZDkyOGJiYTE3Y2FmODguLjExMjYwZmE5Y2JmNDE3OTVkM2Q4 Yjc3ZDdiZDkxYTkwNWNiMjY5ZDUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmlu Zy9SZW5kZXJUaGVtZUVmbC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRl clRoZW1lRWZsLmNwcApAQCAtMTA1NCw3ICsxMDU0LDcgQEAgYm9vbCBSZW5kZXJUaGVtZUVmbDo6 cGFpbnRQcm9ncmVzc0Jhcihjb25zdCBSZW5kZXJPYmplY3QmIG9iamVjdCwgY29uc3QgUGFpbnRJ bmYKICNpZiBFTkFCTEUoVklERU8pCiBTdHJpbmcgUmVuZGVyVGhlbWVFZmw6Om1lZGlhQ29udHJv bHNTdHlsZVNoZWV0KCkKIHsKLSAgICByZXR1cm4gQVNDSUlMaXRlcmFsKG1lZGlhQ29udHJvbHNC YXNlVXNlckFnZW50U3R5bGVTaGVldCk7CisgICAgcmV0dXJuIFN0cmluZyhtZWRpYUNvbnRyb2xz QmFzZVVzZXJBZ2VudFN0eWxlU2hlZXQsIHNpemVvZihtZWRpYUNvbnRyb2xzQmFzZVVzZXJBZ2Vu dFN0eWxlU2hlZXQpKTsKIH0KIAogU3RyaW5nIFJlbmRlclRoZW1lRWZsOjptZWRpYUNvbnRyb2xz U2NyaXB0KCkK