190139 2018-10-01 08:01:41 -0700 [WPE] fix buffer over-read in RenderThemeWPE::mediaControlsStyleSheet() 2018-10-01 10:19:56 -0700 1 1 1 Unclassified WebKit WPE WebKit Other Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 olivier.blin webkit-unassigned bugs-noreply commit-queue mcatanzaro ysuzuki zan oldest_to_newest 1465004 0 olivier.blin 2018-10-01 08:01:41 -0700 Like done for EFL in r210213, see https://bugs.webkit.org/show_bug.cgi?id=166622 This has been detected by a charactersAreAllASCII() assert failure. This is because ASCIILiteral() is wrongly used in mediaControlsStyleSheet(). mediaControlsBaseUserAgentStyleSheet is a char array, not a null-terminated string. It is thus incorrect to use StringImpl::createFromLiteral() that calls strlen() to get the string length. The String::ConstructFromLiteral constructor can not be used, since it skips the last character. 1465005 1 351246 olivier.blin 2018-10-01 08:03:33 -0700 Created attachment 351246 Patch 1465067 2 351246 commit-queue 2018-10-01 10:19:54 -0700 Comment on attachment 351246 Patch Clearing flags on attachment: 351246 Committed r236666: <https://trac.webkit.org/changeset/236666> 1465068 3 commit-queue 2018-10-01 10:19:56 -0700 All reviewed patches have been landed. Closing bug. 351246 2018-10-01 08:03:33 -0700 2018-10-01 10:19:54 -0700 Patch bug-190139-20181001170332.patch text/plain 2074 olivier.blin U3VidmVyc2lvbiBSZXZpc2lvbjogMjM2NjIzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTEyYmM0MDViNzRjZjA2 OWY1ZDU0NzI5MWE4ZjU1NTVjODAyODgyYi4uZTFlNmQ1OTBiMjVlZTFjNTc3ZGU3MDMyMTZlNzY5 ZjM1MjgxMTk4YiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI3IEBACisyMDE4LTEwLTAxICBPbGl2 aWVyIEJsaW4gIDxvbGl2aWVyLmJsaW5Ac29mdGF0aG9tZS5jb20+CisKKyAgICAgICAgW1dQRV0g Zml4IGJ1ZmZlciBvdmVyLXJlYWQgaW4gUmVuZGVyVGhlbWVXUEU6Om1lZGlhQ29udHJvbHNTdHls ZVNoZWV0KCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTE5MDEzOQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IExpa2UgZG9uZSB1cHN0cmVhbSBmb3IgRUZMIGluIHIyMTAyMTMKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2NjYyMgorCisgICAgICAgIFRoaXMgaGFz IGJlZW4gZGV0ZWN0ZWQgYnkgYSBjaGFyYWN0ZXJzQXJlQWxsQVNDSUkoKSBhc3NlcnQgZmFpbHVy ZS4KKworICAgICAgICBUaGlzIGlzIGJlY2F1c2UgQVNDSUlMaXRlcmFsKCkgaXMgd3JvbmdseSB1 c2VkIGluIG1lZGlhQ29udHJvbHNTdHlsZVNoZWV0KCkuCisgICAgICAgIG1lZGlhQ29udHJvbHNC YXNlVXNlckFnZW50U3R5bGVTaGVldCBpcyBhIGNoYXIgYXJyYXksIG5vdCBhIG51bGwtdGVybWlu YXRlZCBzdHJpbmcuCisgICAgICAgIEl0IGlzIHRodXMgaW5jb3JyZWN0IHRvIHVzZSBTdHJpbmdJ bXBsOjpjcmVhdGVGcm9tTGl0ZXJhbCgpIHRoYXQgY2FsbHMKKyAgICAgICAgc3RybGVuKCkgdG8g Z2V0IHRoZSBzdHJpbmcgbGVuZ3RoLgorCisgICAgICAgIFRoZSBTdHJpbmc6OkNvbnN0cnVjdEZy b21MaXRlcmFsIGNvbnN0cnVjdG9yIGNhbiBub3QgYmUgdXNlZCwgc2luY2UgaXQKKyAgICAgICAg c2tpcHMgdGhlIGxhc3QgY2hhcmFjdGVyLgorCisgICAgICAgICogcGxhdGZvcm0vd3BlL1JlbmRl clRoZW1lV1BFLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlclRoZW1lV1BFOjptZWRpYUNv bnRyb2xzU3R5bGVTaGVldCk6CisgICAgICAgIEV4cGxpY2l0ZWx5IHBhc3MgdGhlIHNpemUgdG8g dGhlIFN0cmluZyBjb25zdHJ1Y3Rvci4KKwogMjAxOC0wOS0yOCAgQ2hyaXMgRHVtZXogIDxjZHVt ZXpAYXBwbGUuY29tPgogCiAgICAgICAgIERyb3Agc3VwcG9ydCBmb3IgY3Jvc3Mtb3JpZ2luLXdp bmRvdy1wb2xpY3kgaGVhZGVyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS93 cGUvUmVuZGVyVGhlbWVXUEUuY3BwIGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vd3BlL1JlbmRl clRoZW1lV1BFLmNwcAppbmRleCA5MzhhZWFmMWQyZjRkODJlYTdiZjNkYWYxYTIyYTZmMWZlMzk1 ZGViLi41NjEzYTRmODRmY2E1ODM2MGY5YjU5ZGY4ZmVlMGQ2MDdjMTczMWY2IDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS93cGUvUmVuZGVyVGhlbWVXUEUuY3BwCisrKyBiL1Nv dXJjZS9XZWJDb3JlL3BsYXRmb3JtL3dwZS9SZW5kZXJUaGVtZVdQRS5jcHAKQEAgLTUyLDcgKzUy LDcgQEAgU3RyaW5nIFJlbmRlclRoZW1lV1BFOjpleHRyYURlZmF1bHRTdHlsZVNoZWV0KCkKICNp ZiBFTkFCTEUoVklERU8pCiBTdHJpbmcgUmVuZGVyVGhlbWVXUEU6Om1lZGlhQ29udHJvbHNTdHls ZVNoZWV0KCkKIHsKLSAgICByZXR1cm4gQVNDSUlMaXRlcmFsOjpmcm9tTGl0ZXJhbFVuc2FmZSht ZWRpYUNvbnRyb2xzQmFzZVVzZXJBZ2VudFN0eWxlU2hlZXQpOworICAgIHJldHVybiBTdHJpbmco bWVkaWFDb250cm9sc0Jhc2VVc2VyQWdlbnRTdHlsZVNoZWV0LCBzaXplb2YobWVkaWFDb250cm9s c0Jhc2VVc2VyQWdlbnRTdHlsZVNoZWV0KSk7CiB9CiAKIFN0cmluZyBSZW5kZXJUaGVtZVdQRTo6 bWVkaWFDb250cm9sc1NjcmlwdCgpCg==