205943 2020-01-08 11:42:47 -0800 JSArrayBufferView.h: Multiplication result converted to larger type 2020-01-08 12:54:18 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff commit-queue ews-watchlist keith_miller mark.lam saam tzagallo webkit-bug-importer oldest_to_newest 1604187 0 msaboff 2020-01-08 11:42:47 -0800 Summary: JSArrayBufferView.h: Multiplication result converted to larger type: Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'. static size_t sizeOf(uint32_t length, uint32_t elementSize) { return (length * elementSize + sizeof(EncodedJSValue) - 1) Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'. & ~(sizeof(EncodedJSValue) - 1); } fix: cast length to size_t before multiplication. 1604188 1 msaboff 2020-01-08 11:43:03 -0800 <rdar://problem/58383286> 1604205 2 387122 msaboff 2020-01-08 11:56:24 -0800 Created attachment 387122 Patch 1604241 3 387122 commit-queue 2020-01-08 12:54:16 -0800 Comment on attachment 387122 Patch Clearing flags on attachment: 387122 Committed r254218: <https://trac.webkit.org/changeset/254218> 1604242 4 commit-queue 2020-01-08 12:54:18 -0800 All reviewed patches have been landed. Closing bug. 387122 2020-01-08 11:56:24 -0800 2020-01-08 12:54:16 -0800 Patch 205943.patch text/plain 1340 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjU0MjExKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDIwLTAxLTA4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEpTQXJyYXlCdWZmZXJWaWV3Lmg6IE11bHRpcGxpY2F0aW9uIHJlc3VsdCBjb252ZXJ0ZWQg dG8gbGFyZ2VyIHR5cGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTIwNTk0MworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIEFkZGVkIGNhc3QgdG8gc2l6ZV90IHRvIG1ha2UgdGhlIHdob2xlIGNhbGN1bGF0aW9u IHNpemVfdC4KKworICAgICAgICAqIHJ1bnRpbWUvSlNBcnJheUJ1ZmZlclZpZXcuaDoKKyAgICAg ICAgKEpTQzo6SlNBcnJheUJ1ZmZlclZpZXc6OnNpemVPZik6CisKIDIwMjAtMDEtMDggIEFsZXhl eSBTaHZheWthICA8c2h2YWlrYWxlc2hAZ21haWwuY29tPgogCiAgICAgICAgIFByb3h5J3MgW1tP d25Qcm9wZXJ0eUtleXNdXSBpcyBjb3JyZWN0IG9ubHkgaW4gUHJvcGVydHlOYW1lTW9kZTo6U3Ry aW5nc0FuZFN5bWJvbHMKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTQXJy YXlCdWZmZXJWaWV3LmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRp bWUvSlNBcnJheUJ1ZmZlclZpZXcuaAkocmV2aXNpb24gMjU0MjEwKQorKysgU291cmNlL0phdmFT Y3JpcHRDb3JlL3J1bnRpbWUvSlNBcnJheUJ1ZmZlclZpZXcuaAkod29ya2luZyBjb3B5KQpAQCAt MTA4LDcgKzEwOCw3IEBAIHB1YmxpYzoKICAgICAKICAgICBzdGF0aWMgc2l6ZV90IHNpemVPZih1 aW50MzJfdCBsZW5ndGgsIHVpbnQzMl90IGVsZW1lbnRTaXplKQogICAgIHsKLSAgICAgICAgcmV0 dXJuIChsZW5ndGggKiBlbGVtZW50U2l6ZSArIHNpemVvZihFbmNvZGVkSlNWYWx1ZSkgLSAxKQor ICAgICAgICByZXR1cm4gKHN0YXRpY19jYXN0PHNpemVfdD4obGVuZ3RoKSAqIGVsZW1lbnRTaXpl ICsgc2l6ZW9mKEVuY29kZWRKU1ZhbHVlKSAtIDEpCiAgICAgICAgICAgICAmIH4oc2l6ZW9mKEVu Y29kZWRKU1ZhbHVlKSAtIDEpOwogICAgIH0KIAo=