167773 2017-02-02 19:08:28 -0800 URLParser: Fix parsing invalid IPv4 addresses with non-ASCII characters 2017-02-02 22:32:07 -0800 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 achristensen achristensen oldest_to_newest 1272760 0 achristensen 2017-02-02 19:08:28 -0800 URLParser: Fix parsing invalid IPv4 addresses with non-ASCII characters 1272761 1 300484 achristensen 2017-02-02 19:16:40 -0800 Created attachment 300484 Patch 1272801 2 300484 rniwa 2017-02-02 22:20:25 -0800 Comment on attachment 300484 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=300484&action=review > Source/WebCore/platform/URLParser.cpp:2580 > + const auto hostBegin = iterator; > + Why does moving this declaration make sense? > Source/WebCore/platform/URLParser.cpp:2637 > - if (auto address = parseIPv4Host(CodePointIterator<CharacterType>(hostIterator, iterator))) { > + if (auto address = parseIPv4Host(hostBegin, CodePointIterator<CharacterType>(hostIterator, iterator))) { This whole if (LIKELY(!m_hostHasPercentOrNonASCII)) will exit. > Source/WebCore/platform/URLParser.cpp:-2663 > - > - auto hostBegin = iterator; > - Before we ever execute code beneath this. I think it's cleaner to create a local variable inside LIKELY(!m_hostHasPercentOrNonASCII) instead. 1272805 3 achristensen 2017-02-02 22:32:07 -0800 http://trac.webkit.org/r211621 300484 2017-02-02 19:16:40 -0800 2017-02-02 22:20:25 -0800 Patch bug-167773-20170202191425.patch text/plain 7376 achristensen SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxMTYwMikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI2IEBACisyMDE3LTAyLTAyICBBbGV4IENo cmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgVVJMUGFyc2Vy OiBGaXggcGFyc2luZyBpbnZhbGlkIElQdjQgYWRkcmVzc2VzIHdpdGggbm9uLUFTQ0lJIGNoYXJh Y3RlcnMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2 Nzc3MworICAgICAgICA8cmRhcjovL3Byb2JsZW0vMzAyMjExMDI+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSWYgYW4gaW52YWxpZCBJUHY0IGFkZHJl c3MgY29udGFpbnMgdGhlIGZpcnN0IHN5bnRheFZpb2xhdGlvbiAoZGlmZmVyZW5jZSBiZXR3ZWVu IGlucHV0IGNhbm9uaWNhbGl6ZWQgVVJMKSwKKyAgICAgICAgYW4gaXRlcmF0b3IgaXMgdXNlZCB0 byBjYWxjdWxhdGUgaG93IGZhciB3ZSBoYXZlIHBhcnNlZCBpbiB0aGUgaW5wdXQgc3RyaW5nIHRv IGNvcHkgYWxsIHRoZSBzeW50YXgtdmlvbGF0aW9uLWZyZWUKKyAgICAgICAgY2hhcmFjdGVycyBp bnRvIGEgVmVjdG9yLiBJZiBhIFVSTCBjb250YWlucyBvbmx5IEFTQ0lJIHRoYXQgZG9lc24ndCBj b250YWluIGFueXRoaW5nIHBlcmNlbnQtZW5jb2RlZCBpbiB0aGUgaG9zdCwKKyAgICAgICAgdGhl cmUgaXMgYSBmYXN0IHBhdGggdG8gcGFyc2UgQVNDSUkgaG9zdHMuICBBbGwgbXkgZXhpc3Rpbmcg aW52YWxpZCBJUHY0IHRlc3RzIGZvbGxvd2VkIHRoaXMgcGF0aC4KKyAgICAgICAgSWYgdGhlcmUg aXMgYSBub24tQVNDSUkgY2hhcmFjdGVyLCB3ZSBuZWVkIHRvIHVzZSBhbiBpdGVyYXRvciB0byB0 aGUgb3JpZ2luYWwgc3RyaW5nIGluc3RlYWQgb2YgYW4gaXRlcmF0b3IKKyAgICAgICAgdG8gdGhl IHN0cmluZyBhZnRlciBjb252ZXJ0aW5nIHRoZSBpbnB1dCBzdHJpbmcncyBob3N0IHRvIEFTQ0lJ LgorCisgICAgICAgIENvdmVyZWQgYnkgYSBuZXcgQVBJIHRlc3Qgd2hpY2ggdXNlZCB0byBSRUxF QVNFX0FTU0VSVC4KKworICAgICAgICAqIHBsYXRmb3JtL1VSTFBhcnNlci5jcHA6CisgICAgICAg IChXZWJDb3JlOjpVUkxQYXJzZXI6OnBhcnNlSVB2NEhvc3QpOgorICAgICAgICAoV2ViQ29yZTo6 VVJMUGFyc2VyOjpwYXJzZUlQdjZIb3N0KToKKyAgICAgICAgKFdlYkNvcmU6OlVSTFBhcnNlcjo6 cGFyc2VIb3N0QW5kUG9ydCk6CisgICAgICAgICogcGxhdGZvcm0vVVJMUGFyc2VyLmg6CisKIDIw MTctMDItMDIgIEFsZXggQ2hyaXN0ZW5zZW4gIDxhY2hyaXN0ZW5zZW5Ad2Via2l0Lm9yZz4KIAog ICAgICAgICBCdWlsZCBsaWJ3ZWJydGMgYW5kIGRlcGVuZGVuY2llcyB3aXRoIFhjb2RlCkluZGV4 OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9VUkxQYXJzZXIuY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9XZWJDb3JlL3BsYXRmb3JtL1VSTFBhcnNlci5jcHAJKHJldmlzaW9uIDIxMTYwMikKKysr IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL1VSTFBhcnNlci5jcHAJKHdvcmtpbmcgY29weSkKQEAg LTIyMTQsMTEgKzIyMTQsOSBAQCBBTFdBWVNfSU5MSU5FIHN0YXRpYyB1aW50NjRfdCBwb3cyNTYo c2l6CiAgICAgcmV0dXJuIHZhbHVlc1tleHBvbmVudF07CiB9CiAKLXRlbXBsYXRlPHR5cGVuYW1l IENoYXJhY3RlclR5cGU+Ci1zdGQ6Om9wdGlvbmFsPFVSTFBhcnNlcjo6SVB2NEFkZHJlc3M+IFVS TFBhcnNlcjo6cGFyc2VJUHY0SG9zdChDb2RlUG9pbnRJdGVyYXRvcjxDaGFyYWN0ZXJUeXBlPiBp dGVyYXRvcikKK3RlbXBsYXRlPHR5cGVuYW1lIENoYXJhY3RlclR5cGVGb3JTeW50YXhWaW9sYXRp b24sIHR5cGVuYW1lIENoYXJhY3RlclR5cGU+CitzdGQ6Om9wdGlvbmFsPFVSTFBhcnNlcjo6SVB2 NEFkZHJlc3M+IFVSTFBhcnNlcjo6cGFyc2VJUHY0SG9zdChjb25zdCBDb2RlUG9pbnRJdGVyYXRv cjxDaGFyYWN0ZXJUeXBlRm9yU3ludGF4VmlvbGF0aW9uPiYgaXRlcmF0b3JGb3JTeW50YXhWaW9s YXRpb25Qb3NpdGlvbiwgQ29kZVBvaW50SXRlcmF0b3I8Q2hhcmFjdGVyVHlwZT4gaXRlcmF0b3Ip CiB7Ci0gICAgYXV0byBob3N0QmVnaW4gPSBpdGVyYXRvcjsKLQogICAgIFZlY3Rvcjx1aW50MzJf dCwgND4gaXRlbXM7CiAgICAgaXRlbXMucmVzZXJ2ZUluaXRpYWxDYXBhY2l0eSg0KTsKICAgICBi b29sIGRpZFNlZVN5bnRheFZpb2xhdGlvbiA9IGZhbHNlOwpAQCAtMjI1NSwxNCArMjI1MywxNCBA QCBzdGQ6Om9wdGlvbmFsPFVSTFBhcnNlcjo6SVB2NEFkZHJlc3M+IFVSCiAgICAgICAgIHJldHVy biBzdGQ6Om51bGxvcHQ7CiAKICAgICBpZiAoZGlkU2VlU3ludGF4VmlvbGF0aW9uKQotICAgICAg ICBzeW50YXhWaW9sYXRpb24oaG9zdEJlZ2luKTsKKyAgICAgICAgc3ludGF4VmlvbGF0aW9uKGl0 ZXJhdG9yRm9yU3ludGF4VmlvbGF0aW9uUG9zaXRpb24pOwogICAgIGZvciAoYXV0byBpdGVtIDog aXRlbXMpIHsKICAgICAgICAgaWYgKGl0ZW0gPiAyNTUpCi0gICAgICAgICAgICBzeW50YXhWaW9s YXRpb24oaG9zdEJlZ2luKTsKKyAgICAgICAgICAgIHN5bnRheFZpb2xhdGlvbihpdGVyYXRvckZv clN5bnRheFZpb2xhdGlvblBvc2l0aW9uKTsKICAgICB9CiAKICAgICBpZiAoVU5MSUtFTFkoaXRl bXMuc2l6ZSgpICE9IDQpKQotICAgICAgICBzeW50YXhWaW9sYXRpb24oaG9zdEJlZ2luKTsKKyAg ICAgICAgc3ludGF4VmlvbGF0aW9uKGl0ZXJhdG9yRm9yU3ludGF4VmlvbGF0aW9uUG9zaXRpb24p OwogCiAgICAgSVB2NEFkZHJlc3MgaXB2NCA9IGl0ZW1zLnRha2VMYXN0KCk7CiAgICAgZm9yIChz aXplX3QgY291bnRlciA9IDA7IGNvdW50ZXIgPCBpdGVtcy5zaXplKCk7ICsrY291bnRlcikKQEAg LTIzMjksNyArMjMyNyw3IEBAIHRlbXBsYXRlPHR5cGVuYW1lIENoYXJhY3RlclR5cGU+CiBzdGQ6 Om9wdGlvbmFsPFVSTFBhcnNlcjo6SVB2NkFkZHJlc3M+IFVSTFBhcnNlcjo6cGFyc2VJUHY2SG9z dChDb2RlUG9pbnRJdGVyYXRvcjxDaGFyYWN0ZXJUeXBlPiBjKQogewogICAgIEFTU0VSVCgqYyA9 PSAnWycpOwotICAgIGF1dG8gaG9zdEJlZ2luID0gYzsKKyAgICBjb25zdCBhdXRvIGhvc3RCZWdp biA9IGM7CiAgICAgYWR2YW5jZShjLCBob3N0QmVnaW4pOwogICAgIGlmIChjLmF0RW5kKCkpCiAg ICAgICAgIHJldHVybiBzdGQ6Om51bGxvcHQ7CkBAIC0yNTc4LDYgKzI1NzYsOCBAQCBib29sIFVS TFBhcnNlcjo6cGFyc2VQb3J0KENvZGVQb2ludEl0ZXJhCiB0ZW1wbGF0ZTx0eXBlbmFtZSBDaGFy YWN0ZXJUeXBlPgogYm9vbCBVUkxQYXJzZXI6OnBhcnNlSG9zdEFuZFBvcnQoQ29kZVBvaW50SXRl cmF0b3I8Q2hhcmFjdGVyVHlwZT4gaXRlcmF0b3IpCiB7CisgICAgY29uc3QgYXV0byBob3N0QmVn aW4gPSBpdGVyYXRvcjsKKwogICAgIGlmIChpdGVyYXRvci5hdEVuZCgpKQogICAgICAgICByZXR1 cm4gZmFsc2U7CiAgICAgaWYgKCppdGVyYXRvciA9PSAnOicpCkBAIC0yNjM0LDcgKzI2MzQsNyBA QCBib29sIFVSTFBhcnNlcjo6cGFyc2VIb3N0QW5kUG9ydChDb2RlUG9pCiAgICAgICAgICAgICBp ZiAoaXNJbnZhbGlkRG9tYWluQ2hhcmFjdGVyKCppdGVyYXRvcikpCiAgICAgICAgICAgICAgICAg cmV0dXJuIGZhbHNlOwogICAgICAgICB9Ci0gICAgICAgIGlmIChhdXRvIGFkZHJlc3MgPSBwYXJz ZUlQdjRIb3N0KENvZGVQb2ludEl0ZXJhdG9yPENoYXJhY3RlclR5cGU+KGhvc3RJdGVyYXRvciwg aXRlcmF0b3IpKSkgeworICAgICAgICBpZiAoYXV0byBhZGRyZXNzID0gcGFyc2VJUHY0SG9zdCho b3N0QmVnaW4sIENvZGVQb2ludEl0ZXJhdG9yPENoYXJhY3RlclR5cGU+KGhvc3RJdGVyYXRvciwg aXRlcmF0b3IpKSkgewogICAgICAgICAgICAgc2VyaWFsaXplSVB2NChhZGRyZXNzLnZhbHVlKCkp OwogICAgICAgICAgICAgbV91cmwubV9ob3N0RW5kID0gY3VycmVudFBvc2l0aW9uKGl0ZXJhdG9y KTsKICAgICAgICAgICAgIGlmIChpdGVyYXRvci5hdEVuZCgpKSB7CkBAIC0yNjU4LDkgKzI2NTgs NyBAQCBib29sIFVSTFBhcnNlcjo6cGFyc2VIb3N0QW5kUG9ydChDb2RlUG9pCiAgICAgICAgIG1f dXJsLm1fcG9ydEVuZCA9IGN1cnJlbnRQb3NpdGlvbihpdGVyYXRvcik7CiAgICAgICAgIHJldHVy biB0cnVlOwogICAgIH0KLSAgICAKLSAgICBhdXRvIGhvc3RCZWdpbiA9IGl0ZXJhdG9yOwotICAg IAorCiAgICAgVmVjdG9yPExDaGFyLCBkZWZhdWx0SW5saW5lQnVmZmVyU2l6ZT4gdXRmOEVuY29k ZWQ7CiAgICAgZm9yICg7ICFpdGVyYXRvci5hdEVuZCgpOyArK2l0ZXJhdG9yKSB7CiAgICAgICAg IGlmIChVTkxJS0VMWShpc1RhYk9yTmV3bGluZSgqaXRlcmF0b3IpKSkgewpAQCAtMjY5Miw3ICsy NjkwLDcgQEAgYm9vbCBVUkxQYXJzZXI6OnBhcnNlSG9zdEFuZFBvcnQoQ29kZVBvaQogICAgIFZl Y3RvcjxMQ2hhciwgZGVmYXVsdElubGluZUJ1ZmZlclNpemU+JiBhc2NpaURvbWFpblZhbHVlID0g YXNjaWlEb21haW4udmFsdWUoKTsKICAgICBjb25zdCBMQ2hhciogYXNjaWlEb21haW5DaGFyYWN0 ZXJzID0gYXNjaWlEb21haW5WYWx1ZS5kYXRhKCk7CiAKLSAgICBpZiAoYXV0byBhZGRyZXNzID0g cGFyc2VJUHY0SG9zdChDb2RlUG9pbnRJdGVyYXRvcjxMQ2hhcj4oYXNjaWlEb21haW5WYWx1ZS5i ZWdpbigpLCBhc2NpaURvbWFpblZhbHVlLmVuZCgpKSkpIHsKKyAgICBpZiAoYXV0byBhZGRyZXNz ID0gcGFyc2VJUHY0SG9zdChob3N0QmVnaW4sIENvZGVQb2ludEl0ZXJhdG9yPExDaGFyPihhc2Np aURvbWFpblZhbHVlLmJlZ2luKCksIGFzY2lpRG9tYWluVmFsdWUuZW5kKCkpKSkgewogICAgICAg ICBzZXJpYWxpemVJUHY0KGFkZHJlc3MudmFsdWUoKSk7CiAgICAgICAgIG1fdXJsLm1faG9zdEVu ZCA9IGN1cnJlbnRQb3NpdGlvbihpdGVyYXRvcik7CiAgICAgICAgIGlmIChpdGVyYXRvci5hdEVu ZCgpKSB7CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9VUkxQYXJzZXIuaAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9VUkxQYXJzZXIuaAkocmV2aXNpb24gMjEx NjAyKQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vVVJMUGFyc2VyLmgJKHdvcmtpbmcgY29w eSkKQEAgLTExMCw3ICsxMTAsNyBAQCBwcml2YXRlOgogCiAgICAgdXNpbmcgSVB2NEFkZHJlc3Mg PSB1aW50MzJfdDsKICAgICB2b2lkIHNlcmlhbGl6ZUlQdjQoSVB2NEFkZHJlc3MpOwotICAgIHRl bXBsYXRlPHR5cGVuYW1lIENoYXJhY3RlclR5cGU+IHN0ZDo6b3B0aW9uYWw8SVB2NEFkZHJlc3M+ IHBhcnNlSVB2NEhvc3QoQ29kZVBvaW50SXRlcmF0b3I8Q2hhcmFjdGVyVHlwZT4pOworICAgIHRl bXBsYXRlPHR5cGVuYW1lIENoYXJhY3RlclR5cGVGb3JTeW50YXhWaW9sYXRpb24sIHR5cGVuYW1l IENoYXJhY3RlclR5cGU+IHN0ZDo6b3B0aW9uYWw8SVB2NEFkZHJlc3M+IHBhcnNlSVB2NEhvc3Qo Y29uc3QgQ29kZVBvaW50SXRlcmF0b3I8Q2hhcmFjdGVyVHlwZUZvclN5bnRheFZpb2xhdGlvbj4m LCBDb2RlUG9pbnRJdGVyYXRvcjxDaGFyYWN0ZXJUeXBlPik7CiAgICAgdGVtcGxhdGU8dHlwZW5h bWUgQ2hhcmFjdGVyVHlwZT4gc3RkOjpvcHRpb25hbDx1aW50MzJfdD4gcGFyc2VJUHY0UGllY2Uo Q29kZVBvaW50SXRlcmF0b3I8Q2hhcmFjdGVyVHlwZT4mLCBib29sJiBzeW50YXhWaW9sYXRpb24p OwogICAgIHVzaW5nIElQdjZBZGRyZXNzID0gc3RkOjphcnJheTx1aW50MTZfdCwgOD47CiAgICAg dGVtcGxhdGU8dHlwZW5hbWUgQ2hhcmFjdGVyVHlwZT4gc3RkOjpvcHRpb25hbDxJUHY2QWRkcmVz cz4gcGFyc2VJUHY2SG9zdChDb2RlUG9pbnRJdGVyYXRvcjxDaGFyYWN0ZXJUeXBlPik7CkluZGV4 OiBUb29scy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gVG9vbHMvQ2hhbmdlTG9nCShyZXZpc2lv biAyMTE2MTcpCisrKyBUb29scy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwx NCBAQAorMjAxNy0wMi0wMiAgQWxleCBDaHJpc3RlbnNlbiAgPGFjaHJpc3RlbnNlbkB3ZWJraXQu b3JnPgorCisgICAgICAgIFVSTFBhcnNlcjogRml4IHBhcnNpbmcgaW52YWxpZCBJUHY0IGFkZHJl c3NlcyB3aXRoIG5vbi1BU0NJSSBjaGFyYWN0ZXJzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjc3NzMKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzMw MjIxMTAyPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg ICogVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJDb3JlL1VSTFBhcnNlci5jcHA6CisgICAgICAgIChU ZXN0V2ViS2l0QVBJOjpURVNUX0YpOgorCiAyMDE3LTAyLTAyICBBbGV4ZXkgUHJvc2t1cnlha292 ICA8YXBAYXBwbGUuY29tPgogCiAgICAgICAgIFJlbW92ZSBjaGVjayBmb3IgU2tpcFNhZmFyaUV4 ZWN1dGFibGVFbnRpdGxlbWVudENoZWNrcwpJbmRleDogVG9vbHMvVGVzdFdlYktpdEFQSS9UZXN0 cy9XZWJDb3JlL1VSTFBhcnNlci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gVG9vbHMvVGVzdFdlYktpdEFQ SS9UZXN0cy9XZWJDb3JlL1VSTFBhcnNlci5jcHAJKHJldmlzaW9uIDIxMTYwMikKKysrIFRvb2xz L1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViQ29yZS9VUkxQYXJzZXIuY3BwCSh3b3JraW5nIGNvcHkp CkBAIC0xMjY0LDYgKzEyNjQsNyBAQCBURVNUX0YoVVJMUGFyc2VyVGVzdCwgUGFyc2VyRmFpbHVy ZXMpCiAgICAgc2hvdWxkRmFpbCgiaHR0cDovL1sxMjM0OjphYkBdIik7CiAgICAgc2hvdWxkRmFp bCgiaHR0cDovL1sxMjM0OjphYn5dIik7CiAgICAgc2hvdWxkRmFpbCgiaHR0cDovL1syMDAxOjox Iik7CisgICAgc2hvdWxkRmFpbCgiaHR0cDovLzQ6Ylx4RTEiKTsKICAgICBzaG91bGRGYWlsKCJo dHRwOi8vWzE6MjozOjQ6NTo2Ojc6OH5dLyIpOwogICAgIHNob3VsZEZhaWwoImh0dHA6Ly9bYTpi OmM6ZDplOmY6ZzoxMjcuMC4wLjFdIik7CiAgICAgc2hvdWxkRmFpbCgiaHR0cDovL1thOmI6Yzpk OmU6ZjpnOmg6MTI3LjAuMC4xXSIpOwo=