209132 2020-03-16 00:45:35 -0700 SerializedScriptValue::decode should check bufferIsLargeEnoughToContain before allocating a buffer 2020-03-17 17:32:12 -0700 1 1 1 Unclassified WebKit Bindings WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 209131 1 fujii fujii alecflett beidson cdumez darin ews-watchlist jsbell webkit-bug-importer oldest_to_newest 1630258 0 fujii 2020-03-16 00:45:35 -0700 SerializedScriptValue::decode should check bufferIsLargeEnoughToContain This is a sub-task of Bug 209131. Bug 209131 – Don't allocate a buffer with the decoded size without ensuring bufferIsLargeEnoughToContain(size) 1630259 1 393634 fujii 2020-03-16 00:50:10 -0700 Created attachment 393634 Patch 1630584 2 393714 fujii 2020-03-16 17:23:18 -0700 Created attachment 393714 Patch 1630931 3 393714 darin 2020-03-17 15:38:17 -0700 Comment on attachment 393714 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=393714&action=review > Source/WebCore/ChangeLog:8 > + I have no new tests. The idea here is to state *why* there are no tests. Otherwise please just leave this line out. 1630967 4 fujii 2020-03-17 17:31:25 -0700 Committed r258614: <https://trac.webkit.org/changeset/258614> 1630968 5 webkit-bug-importer 2020-03-17 17:32:12 -0700 <rdar://problem/60562941> 393634 2020-03-16 00:50:10 -0700 2020-03-16 17:23:14 -0700 Patch bug-209132-20200316165008.patch text/plain 1834 fujii U3VidmVyc2lvbiBSZXZpc2lvbjogMjU4NDg2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZmZlNTVlOWI2MzI5OTE3 MWIxNmJiYzVjOGQwYTYwZjFkMGM5ZDY3NS4uYzk4YjhlYjQxNGYxNWRmN2FmMGRmMjVkYTMzY2Uy MTY1ZjFjOWQwMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIwLTAzLTE2ICBGdWpp aSBIaXJvbm9yaSAgPEhpcm9ub3JpLkZ1amlpQHNvbnkuY29tPgorCisgICAgICAgIFNlcmlhbGl6 ZWRTY3JpcHRWYWx1ZTo6ZGVjb2RlIHNob3VsZCBjaGVjayBidWZmZXJJc0xhcmdlRW5vdWdoVG9D b250YWluIGJlZm9yZSBhbGxvY2F0aW5nIGEgYnVmZmVyCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDkxMzIKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJIGhhdmUgbm8gbmV3IHRlc3RzLgorCisgICAgICAg ICogYmluZGluZ3MvanMvU2VyaWFsaXplZFNjcmlwdFZhbHVlLmg6CisgICAgICAgIChXZWJDb3Jl OjpTZXJpYWxpemVkU2NyaXB0VmFsdWU6OmRlY29kZSk6IEFkZGVkIGJ1ZmZlcklzTGFyZ2VFbm91 Z2hUb0NvbnRhaW4gY2hlY2suCisgICAgICAgIEFkZGVkIGEgbnVsbCBjaGVjayBvZiBHaWdhY2Fn ZTo6dHJ5TWFsbG9jLgorCiAyMDIwLTAzLTE1ICBGdWppaSBIaXJvbm9yaSAgPEhpcm9ub3JpLkZ1 amlpQHNvbnkuY29tPgogCiAgICAgICAgIEtleWVkRGVjb2RlckdlbmVyaWMgZmFpbHMgdG8gYWxs b2NhdGUgVmVjdG9yIHdoaWxlIGRlY29kaW5nIGJyb2tlbiBkYXRhCmRpZmYgLS1naXQgYS9Tb3Vy Y2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9TZXJpYWxpemVkU2NyaXB0VmFsdWUuaCBiL1NvdXJjZS9X ZWJDb3JlL2JpbmRpbmdzL2pzL1NlcmlhbGl6ZWRTY3JpcHRWYWx1ZS5oCmluZGV4IGM2YzNmMDZm ZWMzN2ZhOGM5NjQyODEyNThkYzY3MTI5YTk1ZjY3NDQuLjQ1YzRmZGQyMWFjNzY4M2VkM2U2ZTQ1 ZThiNzE1ZDYzOWYwYzhkY2QgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pz L1NlcmlhbGl6ZWRTY3JpcHRWYWx1ZS5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pz L1NlcmlhbGl6ZWRTY3JpcHRWYWx1ZS5oCkBAIC0xNzksOCArMTc5LDEyIEBAIFJlZlB0cjxTZXJp YWxpemVkU2NyaXB0VmFsdWU+IFNlcmlhbGl6ZWRTY3JpcHRWYWx1ZTo6ZGVjb2RlKERlY29kZXIm IGRlY29kZXIpCiAgICAgICAgIHVuc2lnbmVkIGJ1ZmZlclNpemU7CiAgICAgICAgIGlmICghZGVj b2Rlci5kZWNvZGUoYnVmZmVyU2l6ZSkpCiAgICAgICAgICAgICByZXR1cm4gbnVsbHB0cjsKKyAg ICAgICAgaWYgKCFkZWNvZGVyLmJ1ZmZlcklzTGFyZ2VFbm91Z2hUb0NvbnRhaW48dWludDhfdD4o YnVmZmVyU2l6ZSkpCisgICAgICAgICAgICByZXR1cm4gbnVsbHB0cjsKIAogICAgICAgICBhdXRv IGJ1ZmZlciA9IEdpZ2FjYWdlOjp0cnlNYWxsb2MoR2lnYWNhZ2U6OlByaW1pdGl2ZSwgYnVmZmVy U2l6ZSk7CisgICAgICAgIGlmICghYnVmZmVyKQorICAgICAgICAgICAgcmV0dXJuIG51bGxwdHI7 CiAgICAgICAgIGlmICghZGVjb2Rlci5kZWNvZGVGaXhlZExlbmd0aERhdGEoc3RhdGljX2Nhc3Q8 dWludDhfdCo+KGJ1ZmZlciksIGJ1ZmZlclNpemUsIDEpKSB7CiAgICAgICAgICAgICBHaWdhY2Fn ZTo6ZnJlZShHaWdhY2FnZTo6UHJpbWl0aXZlLCBidWZmZXIpOwogICAgICAgICAgICAgcmV0dXJu IG51bGxwdHI7Cg== 393714 2020-03-16 17:23:18 -0700 2020-03-17 15:38:17 -0700 Patch bug-209132-20200317092317.patch text/plain 1813 fujii U3VidmVyc2lvbiBSZXZpc2lvbjogMjU4NTE1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTI4ZmRiMWU5ZDA2NmYw NjJmODEyZTBhOWQ0NmU5YmFjNWIzZmY1ZC4uMzEzZjY4MGZlNjVlZGIyYmU4ODVjNmI2ZDIyZjEy OTEyMGY2YjY2YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIwLTAzLTE2ICBGdWpp aSBIaXJvbm9yaSAgPEhpcm9ub3JpLkZ1amlpQHNvbnkuY29tPgorCisgICAgICAgIFNlcmlhbGl6 ZWRTY3JpcHRWYWx1ZTo6ZGVjb2RlIHNob3VsZCBjaGVjayBidWZmZXJJc0xhcmdlRW5vdWdoVG9D b250YWluIGJlZm9yZSBhbGxvY2F0aW5nIGEgYnVmZmVyCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDkxMzIKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJIGhhdmUgbm8gbmV3IHRlc3RzLgorCisgICAgICAg ICogYmluZGluZ3MvanMvU2VyaWFsaXplZFNjcmlwdFZhbHVlLmg6CisgICAgICAgIChXZWJDb3Jl OjpTZXJpYWxpemVkU2NyaXB0VmFsdWU6OmRlY29kZSk6IEFkZGVkIGJ1ZmZlcklzTGFyZ2VFbm91 Z2hUb0NvbnRhaW4gY2hlY2suCisgICAgICAgIEFkZGVkIGEgbnVsbCBjaGVjayBmb3IgR2lnYWNh Z2U6OnRyeU1hbGxvYy4KKwogMjAyMC0wMy0xNiAgU2ltb24gRnJhc2VyICA8c2ltb24uZnJhc2Vy QGFwcGxlLmNvbT4KIAogICAgICAgICBSZW1vdmUgRnJhbWVWaWV3OjpzY2hlZHVsZVJlbmRlcmlu Z1VwZGF0ZSgpCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9TZXJpYWxp emVkU2NyaXB0VmFsdWUuaCBiL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL1NlcmlhbGl6ZWRT Y3JpcHRWYWx1ZS5oCmluZGV4IGM2YzNmMDZmZWMzN2ZhOGM5NjQyODEyNThkYzY3MTI5YTk1ZjY3 NDQuLjcwNmQxNmMxZWNhMWEzYmFlYjg4NTdlYzA0OGFmMzhmZjAyNmU5YmUgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL1NlcmlhbGl6ZWRTY3JpcHRWYWx1ZS5oCisrKyBi L1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL1NlcmlhbGl6ZWRTY3JpcHRWYWx1ZS5oCkBAIC0x NzksOCArMTc5LDEyIEBAIFJlZlB0cjxTZXJpYWxpemVkU2NyaXB0VmFsdWU+IFNlcmlhbGl6ZWRT Y3JpcHRWYWx1ZTo6ZGVjb2RlKERlY29kZXImIGRlY29kZXIpCiAgICAgICAgIHVuc2lnbmVkIGJ1 ZmZlclNpemU7CiAgICAgICAgIGlmICghZGVjb2Rlci5kZWNvZGUoYnVmZmVyU2l6ZSkpCiAgICAg ICAgICAgICByZXR1cm4gbnVsbHB0cjsKKyAgICAgICAgaWYgKCFkZWNvZGVyLnRlbXBsYXRlIGJ1 ZmZlcklzTGFyZ2VFbm91Z2hUb0NvbnRhaW48dWludDhfdD4oYnVmZmVyU2l6ZSkpCisgICAgICAg ICAgICByZXR1cm4gbnVsbHB0cjsKIAogICAgICAgICBhdXRvIGJ1ZmZlciA9IEdpZ2FjYWdlOjp0 cnlNYWxsb2MoR2lnYWNhZ2U6OlByaW1pdGl2ZSwgYnVmZmVyU2l6ZSk7CisgICAgICAgIGlmICgh YnVmZmVyKQorICAgICAgICAgICAgcmV0dXJuIG51bGxwdHI7CiAgICAgICAgIGlmICghZGVjb2Rl ci5kZWNvZGVGaXhlZExlbmd0aERhdGEoc3RhdGljX2Nhc3Q8dWludDhfdCo+KGJ1ZmZlciksIGJ1 ZmZlclNpemUsIDEpKSB7CiAgICAgICAgICAgICBHaWdhY2FnZTo6ZnJlZShHaWdhY2FnZTo6UHJp bWl0aXZlLCBidWZmZXIpOwogICAgICAgICAgICAgcmV0dXJuIG51bGxwdHI7Cg==