202312 2019-09-27 08:19:06 -0700 operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string. 2019-10-15 21:02:07 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 wuninsu mark.lam bfulgham fpizlo mark.lam product-security rmorisset rniwa webkit-bug-importer ysuzuki oldest_to_newest 1574810 0 379724 wuninsu 2019-09-27 08:19:06 -0700 Created attachment 379724 poc program Hi, during testing, I found this crash input. I tested it with commit ca690fd881e742d539636921af00cf8bc2e3987e in Linux. Current PoC triggers NULL dereference. I don't know this can cause serious security problems like code execution, but I filed it as security at least it can cause some memory corruption. Here is a stack trace from gdb. ``` Thread 1 "jsc" received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] RAX: 0x0 RBX: 0x0 RCX: 0x0 RDX: 0x8 RSI: 0x0 RDI: 0x0 RBP: 0x7fffffffbc60 --> 0x7fffffffbce0 --> 0x7fffffffbd30 --> 0x7fffffffbda0 --> 0x7fffffffbe20 --> 0x7fffffffbef0 --> 0x7fffffffd530 --> 0x7fffffffd640 --> 0x7fffffffd9b0 --> 0x7fffffffd9e0 --> 0x7fffffffdc30 --> 0x7fffffffdce0 --> 0x7ff fffffdd10 --> 0x1cf0c70 (<__libc_csu_init>: push r15) RSP: 0x7fffffffbc60 --> 0x7fffffffbce0 --> 0x7fffffffbd30 --> 0x7fffffffbda0 --> 0x7fffffffbe20 --> 0x7fffffffbef0 --> 0x7fffffffd530 --> 0x7fffffffd640 --> 0x7fffffffd9b0 --> 0x7fffffffd9e0 --> 0x7fffffffdc30 --> 0x7fffffffdce0 --> 0x7ff fffffdd10 --> 0x1cf0c70 (<__libc_csu_init>: push r15) RIP: 0x421f4c (<WTF::StringImpl::length() const+12>: mov eax,DWORD PTR [rdi+0x4]) R8 : 0x0 R9 : 0x7ffff7ffc680 --> 0x0 R10: 0x7ffff7dd5000 --> 0x10102464c457f R11: 0x7ffff4e89260 --> 0x400000 --> 0x10102464c457f R12: 0x7fffb3bfad10 --> 0x68006800680068 ('h') R13: 0x7ffff3fcccc0 --> 0x89a9fbfa41fb3635 R14: 0xfffe000000000000 R15: 0xfffe000000000002 EFLAGS: 0x10206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x421f41 <WTF::StringImpl::length() const+1>: mov rbp,rsp 0x421f44 <WTF::StringImpl::length() const+4>: mov QWORD PTR [rbp-0x8],rdi 0x421f48 <WTF::StringImpl::length() const+8>: mov rdi,QWORD PTR [rbp-0x8] => 0x421f4c <WTF::StringImpl::length() const+12>: mov eax,DWORD PTR [rdi+0x4] 0x421f4f <WTF::StringImpl::length() const+15>: pop rbp 0x421f50 <WTF::StringImpl::length() const+16>: ret 0x421f51: data16 data16 data16 data16 data16 nop WORD PTR cs:[rax+rax*1+0x0] 0x421f60 <WTF::Ref<WTF::AtomStringImpl, WTF::DumbPtrTraits<WTF::AtomStringImpl> >::Ref(WTF::AtomStringImpl&)>: push rbp Stopped reason: SIGSEGV WTF::StringImpl::length (this=0x0) at DerivedSources/ForwardingHeaders/wtf/text/StringImpl.h:274 274 unsigned length() const { return m_length; } gdb-peda$ bt #0 WTF::StringImpl::length (this=0x0) at DerivedSources/ForwardingHeaders/wtf/text/StringImpl.h:274 #1 0x0000000000fbe34d in operationSwitchCharWithUnknownKeyType (exec=0x7fffffffbd30, encodedKey=0x7fffb3998000, tableIndex=0x0) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:2306 #2 0x00007fffb3eff998 in ?? () #3 0x00007fffb3998000 in ?? () #4 0x00007fffb39e4000 in ?? () #5 0x00007fffb39d4000 in ?? () #6 0x00007fffb39d4000 in ?? () #7 0x00007fffb3bfad10 in ?? () #8 0x00007ffff3fcccc0 in ?? () #9 0xfffe000000000000 in ?? () #10 0xfffe000000000002 in ?? () #11 0x00007fffffffbda0 in ?? () #12 0x000000000104faf4 in llint_op_call () #13 0x00007fffb39a3d40 in ?? () #14 0x00007fffb39ac030 in ?? () #15 0x0000001600000001 in ?? () #16 0x00007fffb39e4000 in ?? () #17 0x00007fffb39ac030 in ?? () #18 0x000000000000000a in ?? () #19 0x00007fffb39d4000 in ?? () #20 0x00007fffb39d4000 in ?? () #21 0x00000000004068c0 in ?? () #22 0x00007fffffffddf0 in ?? () #23 0x0000000000000000 in ?? () ``` 1574811 1 webkit-bug-importer 2019-09-27 08:19:20 -0700 <rdar://problem/55782280> 1580319 2 381030 mark.lam 2019-10-15 15:23:25 -0700 Created attachment 381030 proposed patch. 1580324 3 mark.lam 2019-10-15 15:24:27 -0700 @Insu, thanks for the bug report. This is just a null dereference bug due to a missing OOME check. 1580328 4 381030 rmorisset 2019-10-15 15:26:46 -0700 Comment on attachment 381030 proposed patch. r=me 1580337 5 381030 ysuzuki 2019-10-15 15:42:10 -0700 Comment on attachment 381030 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=381030&action=review > Source/JavaScriptCore/jit/JITOperations.cpp:2317 > - StringImpl* value = asString(key)->value(exec).impl(); > - if (value->length() == 1) > + JSString* string = asString(key); > + if (string->length() == 1) { > + StringImpl* value = string->value(exec).impl(); > result = jumpTable.ctiForValue((*value)[0]).executableAddress(); > + } We can create arbitrary rope with length = 1, including substring IIRC. So, let's just check exception. And ensure DFG doesGC and mayExit are saying the right thing. 1580342 6 381034 mark.lam 2019-10-15 15:46:22 -0700 Created attachment 381034 propose patch. 1580344 7 381034 ysuzuki 2019-10-15 15:49:53 -0700 Comment on attachment 381034 propose patch. View in context: https://bugs.webkit.org/attachment.cgi?id=381034&action=review r=me with nit. > Source/JavaScriptCore/jit/JITOperations.cpp:2316 > + StringImpl* value = string->value(exec).impl(); I suggest doing String value = string->value(exec); RETURN_IF_EXCEPTION(throwScope, nullptr); Use value[0] Or value.impl()[0] To make sure that string is live (I think this case is OK, but it is still better I think). 1580403 8 381042 mark.lam 2019-10-15 17:40:05 -0700 Created attachment 381042 proposed patch. 1580409 9 381042 ysuzuki 2019-10-15 17:50:19 -0700 Comment on attachment 381042 proposed patch. r=me 1580440 10 mark.lam 2019-10-15 21:02:07 -0700 Thanks for the review. Landed in r251178: <http://trac.webkit.org/r251178>. 379724 2019-09-27 08:19:06 -0700 2019-09-27 08:19:06 -0700 poc program crash.js text/javascript 196 wuninsu dmFyIG8gPSAoLTEpLnRvTG9jYWxlU3RyaW5nKCkucGFkRW5kKDIgKiogMzEgLSAxLCAiYSIpOwoK ZnVuY3Rpb24gZigpIHsKICAgIHN3aXRjaCAobykgewogICAgICAgIGNhc2UgInQiOgogICAgICAg IGNhc2UgInMiOgogICAgICAgIGNhc2UgInUiOgogICAgfQp9Cgpmb3IgKHZhciBpID0gMDsgaSA8 IDEwMDAwOyBpKyspIHsKICBmKCk7Cn0KCg== 381030 2019-10-15 15:23:25 -0700 2019-10-15 15:46:22 -0700 proposed patch. bug-202312.patch text/plain 3139 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNTExNjApCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEzIEBACisyMDE5LTEwLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBvcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlIGZhaWxl ZCB0byBoYW5kbGUgT09NRSB3aGVuIHJlc29sdmluZyByb3BlIHN0cmluZy4KKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMjMxMgorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNTU3ODIyODA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgKiBzdHJlc3Mvb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5 VHlwZS1zaG91bGQtYXZvaWQtcmVzb2x2aW5nLXJvcGUtc3RyaW5ncy5qczogQWRkZWQuCisKIDIw MTktMTAtMTQgIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBb SlNDXSBHZXR0ZXJTZXR0ZXIgc2hvdWxkIGJlIEpTQ2VsbCwgbm90IEpTT2JqZWN0CkluZGV4OiBK U1Rlc3RzL3N0cmVzcy9vcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlLXNob3Vs ZC1hdm9pZC1yZXNvbHZpbmctcm9wZS1zdHJpbmdzLmpzCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMv c3RyZXNzL29wZXJhdGlvblN3aXRjaENoYXJXaXRoVW5rbm93bktleVR5cGUtc2hvdWxkLWF2b2lk LXJlc29sdmluZy1yb3BlLXN0cmluZ3MuanMJKG5vbmV4aXN0ZW50KQorKysgSlNUZXN0cy9zdHJl c3Mvb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5VHlwZS1zaG91bGQtYXZvaWQtcmVz b2x2aW5nLXJvcGUtc3RyaW5ncy5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDE1IEBACisv L0AgaWYgJG1lbW9yeUxpbWl0ZWQgdGhlbiBza2lwIGVsc2UgcnVuRGVmYXVsdCgiLS11c2VDb25j dXJyZW50SklUPWZhbHNlIikgZW5kCisKK3ZhciBvID0gKC0xKS50b0xvY2FsZVN0cmluZygpLnBh ZEVuZCgyICoqIDMxIC0gMSwgImEiKTsKKworZnVuY3Rpb24gZigpIHsKKyAgICBzd2l0Y2ggKG8p IHsKKyAgICAgICAgY2FzZSAidCI6CisgICAgICAgIGNhc2UgInMiOgorICAgICAgICBjYXNlICJ1 IjoKKyAgICB9Cit9Citub0lubGluZShmKTsKKworZm9yICh2YXIgaSA9IDA7IGkgPCAxMDAwMDsg aSsrKQorICAgIGYoKTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjUx MTU1KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE4IEBACisyMDE5LTEwLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBvcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlIGZhaWxl ZCB0byBoYW5kbGUgT09NRSB3aGVuIHJlc29sdmluZyByb3BlIHN0cmluZy4KKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMjMxMgorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNTU3ODIyODA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5VHlwZSgpIGNh biBvbmx5IGRpc3BhdGNoIHRvIGEgY2FzZSBoYW5kbGVyCisgICAgICAgIGlmIHRoZSBrZXkgc3Ry aW5nIGlzIG9mIGxlbmd0aCAxLiAgQWxsIG90aGVyIGNhc2VzIHNob3VsZCBkaXNwYXRjaCB0byB0 aGUgZGVmYXVsdAorICAgICAgICBoYW5kbGVyLiAgVGhpcyBwYXRjaCByZW1vdmVzIHRoZSBuZWVk IHRvIHJlc29sdmUgYSByb3BlIHN0cmluZyBieSBjaGVja2luZyB0aGUKKyAgICAgICAgc3RyaW5n IGxlbmd0aCBmaXJzdC4KKworICAgICAgICAqIGppdC9KSVRPcGVyYXRpb25zLmNwcDoKKwogMjAx OS0xMC0xNSAgQW5nZWxvcyBPaWtvbm9tb3BvdWxvcyAgPGFvaWtvbm9tb3BvdWxvc0BpZ2FsaWEu Y29tPgogCiAgICAgICAgIEludGVycHJldGVyOiBEb24ndCBhc3NlcnQgdGhhdCByZWZlcmVuY2Ug aXMgbm9ubnVsbApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRPcGVyYXRpb25z LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9wZXJhdGlv bnMuY3BwCShyZXZpc2lvbiAyNTExNTUpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJ VE9wZXJhdGlvbnMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yMzEwLDkgKzIzMTAsMTEgQEAgY2hh ciogSklUX09QRVJBVElPTiBvcGVyYXRpb25Td2l0Y2hDaGFyVwogICAgIHZvaWQqIHJlc3VsdCA9 IGp1bXBUYWJsZS5jdGlEZWZhdWx0LmV4ZWN1dGFibGVBZGRyZXNzKCk7CiAKICAgICBpZiAoa2V5 LmlzU3RyaW5nKCkpIHsKLSAgICAgICAgU3RyaW5nSW1wbCogdmFsdWUgPSBhc1N0cmluZyhrZXkp LT52YWx1ZShleGVjKS5pbXBsKCk7Ci0gICAgICAgIGlmICh2YWx1ZS0+bGVuZ3RoKCkgPT0gMSkK KyAgICAgICAgSlNTdHJpbmcqIHN0cmluZyA9IGFzU3RyaW5nKGtleSk7CisgICAgICAgIGlmIChz dHJpbmctPmxlbmd0aCgpID09IDEpIHsKKyAgICAgICAgICAgIFN0cmluZ0ltcGwqIHZhbHVlID0g c3RyaW5nLT52YWx1ZShleGVjKS5pbXBsKCk7CiAgICAgICAgICAgICByZXN1bHQgPSBqdW1wVGFi bGUuY3RpRm9yVmFsdWUoKCp2YWx1ZSlbMF0pLmV4ZWN1dGFibGVBZGRyZXNzKCk7CisgICAgICAg IH0KICAgICB9CiAKICAgICBhc3NlcnRJc1RhZ2dlZFdpdGgocmVzdWx0LCBKU1N3aXRjaFB0clRh Zyk7Cg== 381034 2019-10-15 15:46:22 -0700 2019-10-15 17:40:05 -0700 propose patch. bug-202312.patch text/plain 3422 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNTExNjApCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEzIEBACisyMDE5LTEwLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBvcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlIGZhaWxl ZCB0byBoYW5kbGUgT09NRSB3aGVuIHJlc29sdmluZyByb3BlIHN0cmluZy4KKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMjMxMgorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNTU3ODIyODA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgKiBzdHJlc3Mvb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5 VHlwZS1zaG91bGQtYXZvaWQtcmVzb2x2aW5nLXJvcGUtc3RyaW5ncy5qczogQWRkZWQuCisKIDIw MTktMTAtMTQgIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBb SlNDXSBHZXR0ZXJTZXR0ZXIgc2hvdWxkIGJlIEpTQ2VsbCwgbm90IEpTT2JqZWN0CkluZGV4OiBK U1Rlc3RzL3N0cmVzcy9vcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlLXNob3Vs ZC1hdm9pZC1yZXNvbHZpbmctcm9wZS1zdHJpbmdzLmpzCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMv c3RyZXNzL29wZXJhdGlvblN3aXRjaENoYXJXaXRoVW5rbm93bktleVR5cGUtc2hvdWxkLWF2b2lk LXJlc29sdmluZy1yb3BlLXN0cmluZ3MuanMJKG5vbmV4aXN0ZW50KQorKysgSlNUZXN0cy9zdHJl c3Mvb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5VHlwZS1zaG91bGQtYXZvaWQtcmVz b2x2aW5nLXJvcGUtc3RyaW5ncy5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDE1IEBACisv L0AgaWYgJG1lbW9yeUxpbWl0ZWQgdGhlbiBza2lwIGVsc2UgcnVuRGVmYXVsdCgiLS11c2VDb25j dXJyZW50SklUPWZhbHNlIikgZW5kCisKK3ZhciBvID0gKC0xKS50b0xvY2FsZVN0cmluZygpLnBh ZEVuZCgyICoqIDMxIC0gMSwgImEiKTsKKworZnVuY3Rpb24gZigpIHsKKyAgICBzd2l0Y2ggKG8p IHsKKyAgICAgICAgY2FzZSAidCI6CisgICAgICAgIGNhc2UgInMiOgorICAgICAgICBjYXNlICJ1 IjoKKyAgICB9Cit9Citub0lubGluZShmKTsKKworZm9yICh2YXIgaSA9IDA7IGkgPCAxMDAwMDsg aSsrKQorICAgIGYoKTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjUx MTU1KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE3IEBACisyMDE5LTEwLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBvcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlIGZhaWxl ZCB0byBoYW5kbGUgT09NRSB3aGVuIHJlc29sdmluZyByb3BlIHN0cmluZy4KKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMjMxMgorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNTU3ODIyODA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5VHlwZSgpIGNh biBvbmx5IGRpc3BhdGNoIHRvIGEgY2FzZSBoYW5kbGVyCisgICAgICAgIGlmIHRoZSBrZXkgc3Ry aW5nIGlzIG9mIGxlbmd0aCAxLiAgQWxsIG90aGVyIGNhc2VzIHNob3VsZCBkaXNwYXRjaCB0byB0 aGUgZGVmYXVsdAorICAgICAgICBoYW5kbGVyLiAgVGhpcyBwYXRjaCBhbHNvIGFkZHMgdGhlIG1p c3NpbmcgT09NRSBjaGVjay4KKworICAgICAgICAqIGppdC9KSVRPcGVyYXRpb25zLmNwcDoKKwog MjAxOS0xMC0xNSAgQW5nZWxvcyBPaWtvbm9tb3BvdWxvcyAgPGFvaWtvbm9tb3BvdWxvc0BpZ2Fs aWEuY29tPgogCiAgICAgICAgIEludGVycHJldGVyOiBEb24ndCBhc3NlcnQgdGhhdCByZWZlcmVu Y2UgaXMgbm9ubnVsbApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRPcGVyYXRp b25zLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9wZXJh dGlvbnMuY3BwCShyZXZpc2lvbiAyNTExNTUpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0 L0pJVE9wZXJhdGlvbnMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yMzAzLDYgKzIzMDMsNyBAQCBj aGFyKiBKSVRfT1BFUkFUSU9OIG9wZXJhdGlvblN3aXRjaENoYXJXCiB7CiAgICAgVk0mIHZtID0g ZXhlYy0+dm0oKTsKICAgICBOYXRpdmVDYWxsRnJhbWVUcmFjZXIgdHJhY2VyKHZtLCBleGVjKTsK KyAgICBhdXRvIHRocm93U2NvcGUgPSBERUNMQVJFX1RIUk9XX1NDT1BFKHZtKTsKICAgICBKU1Zh bHVlIGtleSA9IEpTVmFsdWU6OmRlY29kZShlbmNvZGVkS2V5KTsKICAgICBDb2RlQmxvY2sqIGNv ZGVCbG9jayA9IGV4ZWMtPmNvZGVCbG9jaygpOwogCkBAIC0yMzEwLDkgKzIzMTEsMTIgQEAgY2hh ciogSklUX09QRVJBVElPTiBvcGVyYXRpb25Td2l0Y2hDaGFyVwogICAgIHZvaWQqIHJlc3VsdCA9 IGp1bXBUYWJsZS5jdGlEZWZhdWx0LmV4ZWN1dGFibGVBZGRyZXNzKCk7CiAKICAgICBpZiAoa2V5 LmlzU3RyaW5nKCkpIHsKLSAgICAgICAgU3RyaW5nSW1wbCogdmFsdWUgPSBhc1N0cmluZyhrZXkp LT52YWx1ZShleGVjKS5pbXBsKCk7Ci0gICAgICAgIGlmICh2YWx1ZS0+bGVuZ3RoKCkgPT0gMSkK KyAgICAgICAgSlNTdHJpbmcqIHN0cmluZyA9IGFzU3RyaW5nKGtleSk7CisgICAgICAgIGlmIChz dHJpbmctPmxlbmd0aCgpID09IDEpIHsKKyAgICAgICAgICAgIFN0cmluZ0ltcGwqIHZhbHVlID0g c3RyaW5nLT52YWx1ZShleGVjKS5pbXBsKCk7CisgICAgICAgICAgICBSRVRVUk5fSUZfRVhDRVBU SU9OKHRocm93U2NvcGUsIG51bGxwdHIpOwogICAgICAgICAgICAgcmVzdWx0ID0ganVtcFRhYmxl LmN0aUZvclZhbHVlKCgqdmFsdWUpWzBdKS5leGVjdXRhYmxlQWRkcmVzcygpOworICAgICAgICB9 CiAgICAgfQogCiAgICAgYXNzZXJ0SXNUYWdnZWRXaXRoKHJlc3VsdCwgSlNTd2l0Y2hQdHJUYWcp Owo= 381042 2019-10-15 17:40:05 -0700 2019-10-15 17:50:19 -0700 proposed patch. bug-202312.patch text/plain 6810 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNTExNzApCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE3IEBACisyMDE5LTEwLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBvcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlIGZhaWxl ZCB0byBoYW5kbGUgT09NRSB3aGVuIHJlc29sdmluZyByb3BlIHN0cmluZy4KKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMjMxMgorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNTU3ODIyODA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgKiBzdHJlc3Mvb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5 VHlwZS1zaG91bGQtYXZvaWQtcmVzb2x2aW5nLXJvcGUtc3RyaW5ncy5qczogQWRkZWQuCisgICAg ICAgICogc3RyZXNzL29wZXJhdGlvblN3aXRjaENoYXJXaXRoVW5rbm93bktleVR5cGUtc2hvdWxk LWF2b2lkLXJlc29sdmluZy1yb3BlLXN0cmluZ3MyLmpzOiBBZGRlZC4KKyAgICAgICAgKiBzdHJl c3Mvc3dpdGNoLW9uLWNoYXItbGxpbnQtcm9wZS5qczoKKyAgICAgICAgLSBDaGFuZ2VkIHRoaXMg dGVzdCB0byBtYWtlIGEgbmV3IHJvcGUgc3RyaW5nIGZvciBlYWNoIGl0ZXJhdGlvbnMuICBPdGhl cndpc2UsCisgICAgICAgICAgdGhlIHJvcGUgd2lsbCBnZXQgcmVzb2x2ZWQsIGFuZCBzdWJzZXF1 ZW50IHRpZXJzIHdpbGwgbm90IGJlIHRlc3Rpbmcgd2l0aCBhIHJvcGUuCisKIDIwMTktMTAtMTQg IFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBbSlNDXSBHZXR0 ZXJTZXR0ZXIgc2hvdWxkIGJlIEpTQ2VsbCwgbm90IEpTT2JqZWN0CkluZGV4OiBKU1Rlc3RzL3N0 cmVzcy9vcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlLXNob3VsZC1hdm9pZC1y ZXNvbHZpbmctcm9wZS1zdHJpbmdzMi5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3RzL3N0cmVzcy9v cGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlLXNob3VsZC1hdm9pZC1yZXNvbHZp bmctcm9wZS1zdHJpbmdzMi5qcwkobm9uZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVzcy9vcGVy YXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBlLXNob3VsZC1hdm9pZC1yZXNvbHZpbmct cm9wZS1zdHJpbmdzMi5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDI0IEBACisvL0AgaWYg JG1lbW9yeUxpbWl0ZWQgdGhlbiBza2lwIGVsc2UgcnVuRGVmYXVsdCgiLS11c2VDb25jdXJyZW50 SklUPWZhbHNlIikgZW5kCisvL0Agc2xvdyEKKworZnVuY3Rpb24gZihvKSB7CisgICAgc3dpdGNo IChvKSB7CisgICAgICAgIGNhc2UgInQiOgorICAgICAgICBjYXNlICJzIjoKKyAgICAgICAgY2Fz ZSAidSI6CisgICAgfQorfQorbm9JbmxpbmUoZik7CisKK2ZvciAodmFyIGkgPSAwOyBpIDwgMTAw MDA7IGkrKykgeworICAgIGxldCBvOworICAgIC8vIFRoaXMgdGVzdCBuZWVkcyB0byBhbGxvY2F0 ZSBhIGxhcmdlIHJvcGUgc3RyaW5nLCB3aGljaCBpcyBzbG93LgorICAgIC8vIFRoZSBmb2xsb3dp bmcgaXMgdHdlYWtlZCBzbyB0aGF0IHdlIG9ubHkgdXNlIHRoaXMgbGFyZ2Ugc3RyaW5nIG9uY2Ug ZWFjaCB0bworICAgIC8vIGV4ZXJjaXNlIHRoZSBsbGludCwgYmFzZWxpbmUsIERGRywgYW5kIEZU TCwgc28gdGhhdCB0aGUgdGVzdCBkb2Vzbid0IHJ1biB0b28gc2xvdy4KKyAgICBpZiAoaSA9PSAw IHx8IGkgPT0gOTkgfHwgaSA9PSAyMDAgfHwgaSA9PSA5OTk5KQorICAgICAgICBvID0gKC0xKS50 b0xvY2FsZVN0cmluZygpLnBhZEVuZCgyICoqIDMxIC0gMSwgImEiKTsKKyAgICBlbHNlCisgICAg ICAgIG8gPSAoLTEpLnRvTG9jYWxlU3RyaW5nKCkucGFkRW5kKDIsICJhIik7CisgICAgZihvKTsK K30KKwpJbmRleDogSlNUZXN0cy9zdHJlc3Mvb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3du S2V5VHlwZS1zaG91bGQtYXZvaWQtcmVzb2x2aW5nLXJvcGUtc3RyaW5ncy5qcwo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBKU1Rlc3RzL3N0cmVzcy9vcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBl LXNob3VsZC1hdm9pZC1yZXNvbHZpbmctcm9wZS1zdHJpbmdzLmpzCShub25leGlzdGVudCkKKysr IEpTVGVzdHMvc3RyZXNzL29wZXJhdGlvblN3aXRjaENoYXJXaXRoVW5rbm93bktleVR5cGUtc2hv dWxkLWF2b2lkLXJlc29sdmluZy1yb3BlLXN0cmluZ3MuanMJKHdvcmtpbmcgY29weSkKQEAgLTAs MCArMSwxNyBAQAorLy9AIGlmICRtZW1vcnlMaW1pdGVkIHRoZW4gc2tpcCBlbHNlIHJ1bkRlZmF1 bHQoIi0tdXNlQ29uY3VycmVudEpJVD1mYWxzZSIpIGVuZAorLy9AIHNsb3chCisKK3ZhciBvID0g KC0xKS50b0xvY2FsZVN0cmluZygpLnBhZEVuZCgyICoqIDMxIC0gMSwgImEiKTsKKworZnVuY3Rp b24gZigpIHsKKyAgICBzd2l0Y2ggKG8pIHsKKyAgICAgICAgY2FzZSAidCI6CisgICAgICAgIGNh c2UgInMiOgorICAgICAgICBjYXNlICJ1IjoKKyAgICB9Cit9Citub0lubGluZShmKTsKKworZm9y ICh2YXIgaSA9IDA7IGkgPCAxMDAwMDsgaSsrKQorICAgIGYoKTsKKwpJbmRleDogSlNUZXN0cy9z dHJlc3Mvc3dpdGNoLW9uLWNoYXItbGxpbnQtcm9wZS5qcwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3Rz L3N0cmVzcy9zd2l0Y2gtb24tY2hhci1sbGludC1yb3BlLmpzCShyZXZpc2lvbiAyNTExNTUpCisr KyBKU1Rlc3RzL3N0cmVzcy9zd2l0Y2gtb24tY2hhci1sbGludC1yb3BlLmpzCSh3b3JraW5nIGNv cHkpCkBAIC0xNCw4ICsxNCw4IEBAIGZ1bmN0aW9uIGZvbyh6KSB7CiB9CiBub0lubGluZShmb28p OwogCi1sZXQgc3RyID0gJ2EnICsgY29uc3RTdHIoKTsKIGZvciAobGV0IGkgPSAwOyBpIDwgMTAw MDA7ICsraSkgeworICAgIGxldCBzdHIgPSAnYScgKyBjb25zdFN0cigpOwogICAgIGxldCByZXN1 bHQgPSBmb28oc3RyKTsKICAgICBpZiAocmVzdWx0ICE9PSAyKQogICAgICAgICB0aHJvdyBuZXcg RXJyb3IoIkJhZCByZXN1bHQiKTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VM b2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNp b24gMjUxMTU1KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBj b3B5KQpAQCAtMSwzICsxLDIzIEBACisyMDE5LTEwLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFw cGxlLmNvbT4KKworICAgICAgICBvcGVyYXRpb25Td2l0Y2hDaGFyV2l0aFVua25vd25LZXlUeXBl IGZhaWxlZCB0byBoYW5kbGUgT09NRSB3aGVuIHJlc29sdmluZyByb3BlIHN0cmluZy4KKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMjMxMgorICAgICAg ICA8cmRhcjovL3Byb2JsZW0vNTU3ODIyODA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgb3BlcmF0aW9uU3dpdGNoQ2hhcldpdGhVbmtub3duS2V5VHlw ZSgpIGNhbiBvbmx5IGRpc3BhdGNoIHRvIGEgY2FzZSBoYW5kbGVyCisgICAgICAgIGlmIHRoZSBr ZXkgc3RyaW5nIGlzIG9mIGxlbmd0aCAxLiAgQWxsIG90aGVyIGNhc2VzIHNob3VsZCBkaXNwYXRj aCB0byB0aGUgZGVmYXVsdAorICAgICAgICBoYW5kbGVyLiAgVGhpcyBwYXRjaCBhbHNvIGFkZHMg dGhlIG1pc3NpbmcgT09NRSBjaGVjay4KKworICAgICAgICBBbHNvIGZpeGVkIGEgYnVnIGluIFNw ZWN1bGF0aXZlSklUOjplbWl0U3dpdGNoQ2hhclN0cmluZ0p1bXAoKSB3aGVyZSB0aGUgc2xvdwor ICAgICAgICBwYXRoIHJvcGUgcmVzb2x1dGlvbiB3YXMgcmV0dXJuaW5nIGFmdGVyIHRoZSBsZW5n dGggY2hlY2suICBJdCBuZWVkcyB0byByZXR1cm4gdG8KKyAgICAgICAgdGhlIHBvaW50IGJlZm9y ZSB0aGUgbGVuZ3RoIGNoZWNrLgorCisgICAgICAgICogZGZnL0RGR1NwZWN1bGF0aXZlSklULmNw cDoKKyAgICAgICAgKEpTQzo6REZHOjpTcGVjdWxhdGl2ZUpJVDo6ZW1pdFN3aXRjaENoYXJTdHJp bmdKdW1wKToKKyAgICAgICAgKiBqaXQvSklUT3BlcmF0aW9ucy5jcHA6CisKIDIwMTktMTAtMTUg IEFuZ2Vsb3MgT2lrb25vbW9wb3Vsb3MgIDxhb2lrb25vbW9wb3Vsb3NAaWdhbGlhLmNvbT4KIAog ICAgICAgICBJbnRlcnByZXRlcjogRG9uJ3QgYXNzZXJ0IHRoYXQgcmVmZXJlbmNlIGlzIG5vbm51 bGwKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuY3Bw Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVK SVQuY3BwCShyZXZpc2lvbiAyNTExNTUpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG R1NwZWN1bGF0aXZlSklULmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTA3MTksMTYgKzEwNzE5LDE1 IEBAIHZvaWQgU3BlY3VsYXRpdmVKSVQ6OmVtaXRTd2l0Y2hDaGFyU3RyaW4KIHsKICAgICBtX2pp dC5sb2FkUHRyKE1hY3JvQXNzZW1ibGVyOjpBZGRyZXNzKHZhbHVlLCBKU1N0cmluZzo6b2Zmc2V0 T2ZWYWx1ZSgpKSwgc2NyYXRjaCk7CiAgICAgYXV0byBpc1JvcGUgPSBtX2ppdC5icmFuY2hJZlJv cGVTdHJpbmdJbXBsKHNjcmF0Y2gpOwotCisgICAgYWRkU2xvd1BhdGhHZW5lcmF0b3Ioc2xvd1Bh dGhDYWxsKGlzUm9wZSwgdGhpcywgb3BlcmF0aW9uUmVzb2x2ZVJvcGUsIHNjcmF0Y2gsIHZhbHVl KSk7CisgICAgCiAgICAgYWRkQnJhbmNoKAogICAgICAgICBtX2ppdC5icmFuY2gzMigKICAgICAg ICAgICAgIE1hY3JvQXNzZW1ibGVyOjpOb3RFcXVhbCwKICAgICAgICAgICAgIE1hY3JvQXNzZW1i bGVyOjpBZGRyZXNzKHNjcmF0Y2gsIFN0cmluZ0ltcGw6Omxlbmd0aE1lbW9yeU9mZnNldCgpKSwK ICAgICAgICAgICAgIFRydXN0ZWRJbW0zMigxKSksCiAgICAgICAgIGRhdGEtPmZhbGxUaHJvdWdo LmJsb2NrKTsKLSAgICAKLSAgICBhZGRTbG93UGF0aEdlbmVyYXRvcihzbG93UGF0aENhbGwoaXNS b3BlLCB0aGlzLCBvcGVyYXRpb25SZXNvbHZlUm9wZSwgc2NyYXRjaCwgdmFsdWUpKTsKLSAgICAK KwogICAgIG1faml0LmxvYWRQdHIoTWFjcm9Bc3NlbWJsZXI6OkFkZHJlc3Moc2NyYXRjaCwgU3Ry aW5nSW1wbDo6ZGF0YU9mZnNldCgpKSwgdmFsdWUpOwogICAgIAogICAgIEpJVENvbXBpbGVyOjpK dW1wIGlzOEJpdCA9IG1faml0LmJyYW5jaFRlc3QzMigKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9qaXQvSklUT3BlcmF0aW9ucy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3Jp cHRDb3JlL2ppdC9KSVRPcGVyYXRpb25zLmNwcAkocmV2aXNpb24gMjUxMTU1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL2ppdC9KSVRPcGVyYXRpb25zLmNwcAkod29ya2luZyBjb3B5KQpAQCAt MjMwMyw2ICsyMzAzLDcgQEAgY2hhciogSklUX09QRVJBVElPTiBvcGVyYXRpb25Td2l0Y2hDaGFy VwogewogICAgIFZNJiB2bSA9IGV4ZWMtPnZtKCk7CiAgICAgTmF0aXZlQ2FsbEZyYW1lVHJhY2Vy IHRyYWNlcih2bSwgZXhlYyk7CisgICAgYXV0byB0aHJvd1Njb3BlID0gREVDTEFSRV9USFJPV19T Q09QRSh2bSk7CiAgICAgSlNWYWx1ZSBrZXkgPSBKU1ZhbHVlOjpkZWNvZGUoZW5jb2RlZEtleSk7 CiAgICAgQ29kZUJsb2NrKiBjb2RlQmxvY2sgPSBleGVjLT5jb2RlQmxvY2soKTsKIApAQCAtMjMx MCw5ICsyMzExLDEyIEBAIGNoYXIqIEpJVF9PUEVSQVRJT04gb3BlcmF0aW9uU3dpdGNoQ2hhclcK ICAgICB2b2lkKiByZXN1bHQgPSBqdW1wVGFibGUuY3RpRGVmYXVsdC5leGVjdXRhYmxlQWRkcmVz cygpOwogCiAgICAgaWYgKGtleS5pc1N0cmluZygpKSB7Ci0gICAgICAgIFN0cmluZ0ltcGwqIHZh bHVlID0gYXNTdHJpbmcoa2V5KS0+dmFsdWUoZXhlYykuaW1wbCgpOwotICAgICAgICBpZiAodmFs dWUtPmxlbmd0aCgpID09IDEpCi0gICAgICAgICAgICByZXN1bHQgPSBqdW1wVGFibGUuY3RpRm9y VmFsdWUoKCp2YWx1ZSlbMF0pLmV4ZWN1dGFibGVBZGRyZXNzKCk7CisgICAgICAgIEpTU3RyaW5n KiBzdHJpbmcgPSBhc1N0cmluZyhrZXkpOworICAgICAgICBpZiAoc3RyaW5nLT5sZW5ndGgoKSA9 PSAxKSB7CisgICAgICAgICAgICBTdHJpbmcgdmFsdWUgPSBzdHJpbmctPnZhbHVlKGV4ZWMpOwor ICAgICAgICAgICAgUkVUVVJOX0lGX0VYQ0VQVElPTih0aHJvd1Njb3BlLCBudWxscHRyKTsKKyAg ICAgICAgICAgIHJlc3VsdCA9IGp1bXBUYWJsZS5jdGlGb3JWYWx1ZSh2YWx1ZVswXSkuZXhlY3V0 YWJsZUFkZHJlc3MoKTsKKyAgICAgICAgfQogICAgIH0KIAogICAgIGFzc2VydElzVGFnZ2VkV2l0 aChyZXN1bHQsIEpTU3dpdGNoUHRyVGFnKTsK