188740 2018-08-20 00:31:02 -0700 [JSC] HeapUtil should care about pointer overflow 2018-08-21 22:06:19 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ysuzuki ysuzuki ews-watchlist keith_miller mark.lam msaboff saam webkit-bug-importer oldest_to_newest 1451545 0 ysuzuki 2018-08-20 00:31:02 -0700 [JSC] HeapUtil should care pointer overflow 1451547 1 347485 ysuzuki 2018-08-20 00:55:11 -0700 Created attachment 347485 Patch 1452505 2 347485 saam 2018-08-21 19:53:28 -0700 Comment on attachment 347485 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=347485&action=review > Source/JavaScriptCore/ChangeLog:3 > + [JSC] HeapUtil should care pointer overflow care pointer => care about pointer > Source/JavaScriptCore/ChangeLog:8 > + `pointer - sizeof(IndexingHeader) - 1` causes an undefined behavior if a pointer is overflow. is overflow => overflows 1452529 3 347485 ysuzuki 2018-08-21 22:04:02 -0700 Comment on attachment 347485 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=347485&action=review Thank you! >> Source/JavaScriptCore/ChangeLog:3 >> + [JSC] HeapUtil should care pointer overflow > > care pointer => care about pointer Thanks, fixed. >> Source/JavaScriptCore/ChangeLog:8 >> + `pointer - sizeof(IndexingHeader) - 1` causes an undefined behavior if a pointer is overflow. > > is overflow => overflows Fixed. 1452530 4 ysuzuki 2018-08-21 22:05:13 -0700 Committed r235161: <https://trac.webkit.org/changeset/235161> 1452532 5 webkit-bug-importer 2018-08-21 22:06:19 -0700 <rdar://problem/43592586> 347485 2018-08-20 00:55:11 -0700 2018-08-21 19:53:28 -0700 Patch bug-188740-20180820165510.patch text/plain 2020 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjM1MDI0CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA4 ZjRmMzM4MGI5ZDY4MDgxZjE0YjQ1YTVjYzUzZDNiNzA5ODNmZjkxLi42ZDU0ZGMwYjEwNjNhMjVk ZTkzYzk4ZDQxZDljMjE4MzYxNzM3OTdlIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNyBAQAorMjAxOC0wOC0yMCAgWXVzdWtlIFN1enVraSAgPHl1c3VrZXN1enVraUBzbG93 c3RhcnQub3JnPgorCisgICAgICAgIFtKU0NdIEhlYXBVdGlsIHNob3VsZCBjYXJlIHBvaW50ZXIg b3ZlcmZsb3cKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTE4ODc0MAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IGBwb2ludGVyIC0gc2l6ZW9mKEluZGV4aW5nSGVhZGVyKSAtIDFgIGNhdXNlcyBhbiB1bmRlZmlu ZWQgYmVoYXZpb3IgaWYgYSBwb2ludGVyIGlzIG92ZXJmbG93LgorICAgICAgICBGb3IgZXhhbXBs ZSwgaWYgYHBvaW50ZXJgIGlzIG51bGxwdHIsIGl0IGNhdXNlcyBwb2ludGVyIG92ZXJmbG93LiBJ bnN0ZWFkIG9mIGNhbGN1bGF0aW5nIHRoaXMKKyAgICAgICAgd2l0aCBgY2hhcipgIHBvaW50ZXIs IHdlIGNhc3QgaXQgdG8gYHVpbnRwdHJfdGAgdGVtcG9yYXJpbHkuIFRoaXMgaXNzdWUgaXMgZm91 bmQgYnkgVUJTYW4uCisKKyAgICAgICAgKiBoZWFwL0hlYXBVdGlsLmg6CisgICAgICAgIChKU0M6 OkhlYXBVdGlsOjpmaW5kR0NPYmplY3RQb2ludGVyc0Zvck1hcmtpbmcpOgorCiAyMDE4LTA4LTE5 ICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlhLmNvbT4KIAogICAgICAgICBb R0xJQl0gQWRkIEFQSSB0byB0aHJvdyBleGNlcHRpb25zIHVzaW5nIHByaW50ZiBmb3JtYXR0ZWQg c3RyaW5ncwpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvSGVhcFV0aWwu aCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFwL0hlYXBVdGlsLmgKaW5kZXggOWVmMDNlYTZm Y2Q5ODdkNGE5OGZjN2ViMTk0NDRkMTA4NWNjMGQwNS4uZjk0ZGYwM2MxYmVlZDE4NTBhOGEzZjFl OTBiNmVjODBmOTI3YTJlZCAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAv SGVhcFV0aWwuaAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaGVhcC9IZWFwVXRpbC5oCkBA IC04NCw3ICs4NCw3IEBAIGNsYXNzIEhlYXBVdGlsIHsKICAgICAgICAgLy8gSXQncyBwb3NzaWJs ZSBmb3IgYSBidXR0ZXJmbHkgcG9pbnRlciB0byBwb2ludCBwYXN0IHRoZSBlbmQgb2YgYSBidXR0 ZXJmbHkuIENoZWNrIHRoaXMgbm93LgogICAgICAgICBpZiAocG9pbnRlciA8PSBiaXR3aXNlX2Nh c3Q8Y2hhcio+KGNhbmRpZGF0ZSkgKyBzaXplb2YoSW5kZXhpbmdIZWFkZXIpKSB7CiAgICAgICAg ICAgICAvLyBXZSBtYXkgYmUgaW50ZXJlc3RlZCBpbiB0aGUgbGFzdCBjZWxsIG9mIHRoZSBwcmV2 aW91cyBNYXJrZWRCbG9jay4KLSAgICAgICAgICAgIGNoYXIqIHByZXZpb3VzUG9pbnRlciA9IHBv aW50ZXIgLSBzaXplb2YoSW5kZXhpbmdIZWFkZXIpIC0gMTsKKyAgICAgICAgICAgIGNoYXIqIHBy ZXZpb3VzUG9pbnRlciA9IGJpdHdpc2VfY2FzdDxjaGFyKj4oYml0d2lzZV9jYXN0PHVpbnRwdHJf dD4ocG9pbnRlcikgLSBzaXplb2YoSW5kZXhpbmdIZWFkZXIpIC0gMSk7CiAgICAgICAgICAgICBN YXJrZWRCbG9jayogcHJldmlvdXNDYW5kaWRhdGUgPSBNYXJrZWRCbG9jazo6YmxvY2tGb3IocHJl dmlvdXNQb2ludGVyKTsKICAgICAgICAgICAgIGlmICghZmlsdGVyLnJ1bGVPdXQoYml0d2lzZV9j YXN0PEJpdHM+KHByZXZpb3VzQ2FuZGlkYXRlKSkKICAgICAgICAgICAgICAgICAmJiBzZXQuY29u dGFpbnMocHJldmlvdXNDYW5kaWRhdGUpCg==