22134 2008-11-07 17:00:25 -0800 -[WebHistoryItem dictionaryRepresentation] accesses past the end of a vector 2008-11-11 14:14:59 -0800 1 1 1 Unclassified WebKit History 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED P2 Normal --- 1 agolden webkit-unassigned ddkilzer oldest_to_newest 97985 0 agolden 2008-11-07 17:00:25 -0800 The for loop to iterate over the children vector in -[WebHistoryItem dictionaryRepresentation] starts out with i = children.size(), so if we ever hit that loop we're going to attempt an access past the end of the children vector. It should be i = children.size()-1. 97986 1 24979 agolden 2008-11-07 17:05:48 -0800 Created attachment 24979 This patch prevents the bad access. 97987 2 24980 agolden 2008-11-07 17:11:58 -0800 Created attachment 24980 Same patch as before, but with a bit more whitespace and a ChangeLog... 98090 3 24980 darin 2008-11-09 11:50:56 -0800 Comment on attachment 24980 Same patch as before, but with a bit more whitespace and a ChangeLog... This change is clearly correct, but we normally require regression tests for bug fixes. Were you able to reproduce a problem? I'd love to see a test and not just the fix. r=me 98194 4 25025 agolden 2008-11-10 12:42:30 -0800 Created attachment 25025 New patch It turns out that -[WebHistoryItem initWithDictionaryRepresentation] has the same problem as -[WebHistoryItem dictionaryRepresentation] so fixing that as well and updating the ChangeLog. 98212 5 24980 ddkilzer 2008-11-10 14:42:42 -0800 Comment on attachment 24980 Same patch as before, but with a bit more whitespace and a ChangeLog... Clearing review flag on unlanded patch. 98217 6 agolden 2008-11-10 15:06:05 -0800 (In reply to comment #3) > (From update of attachment 24980 [review]) > This change is clearly correct, but we normally require regression tests for > bug fixes. Were you able to reproduce a problem? I'd love to see a test and not > just the fix. > > r=me > I think that the affected API is not currently used in the Safari browser, so I will not be able to provide a layout test. In theory I could write a new application designed to demonstrate the problem, but in this case I doubt that it's necessary. 98295 7 25025 ggaren 2008-11-11 09:24:43 -0800 Comment on attachment 25025 New patch r=me 98343 8 ddkilzer 2008-11-11 14:14:59 -0800 $ git svn dcommit Committing to http://svn.webkit.org/repository/webkit/trunk ... M WebKit/mac/ChangeLog M WebKit/mac/History/WebHistoryItem.mm Committed r38315 24979 2008-11-07 17:05:48 -0800 2008-11-10 12:42:30 -0800 This patch prevents the bad access. patch.txt text/plain 674 agolden SW5kZXg6IFdlYktpdC9tYWMvSGlzdG9yeS9XZWJIaXN0b3J5SXRlbS5tbQo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBXZWJLaXQvbWFjL0hpc3RvcnkvV2ViSGlzdG9yeUl0ZW0ubW0JKHJldmlzaW9uIDM4MjMyKQor KysgV2ViS2l0L21hYy9IaXN0b3J5L1dlYkhpc3RvcnlJdGVtLm1tCSh3b3JraW5nIGNvcHkpCkBA IC00MTAsNyArNDEwLDcgQEAKICAgICAgICAgY29uc3QgSGlzdG9yeUl0ZW1WZWN0b3ImIGNoaWxk cmVuID0gY29yZUl0ZW0tPmNoaWxkcmVuKCk7CiAgICAgICAgIE5TTXV0YWJsZUFycmF5ICpjaGls ZERpY3RzID0gW05TTXV0YWJsZUFycmF5IGFycmF5V2l0aENhcGFjaXR5OmNoaWxkcmVuLnNpemUo KV07CiAgICAgICAgIAotICAgICAgICBmb3IgKGludCBpID0gY2hpbGRyZW4uc2l6ZSgpOyBpID49 IDA7IGktLSkKKyAgICAgICAgZm9yIChpbnQgaSA9IGNoaWxkcmVuLnNpemUoKS0xOyBpID49IDA7 IGktLSkKICAgICAgICAgICAgIFtjaGlsZERpY3RzIGFkZE9iamVjdDpba2l0KGNoaWxkcmVuW2ld LmdldCgpKSBkaWN0aW9uYXJ5UmVwcmVzZW50YXRpb25dXTsKICAgICAgICAgW2RpY3Qgc2V0T2Jq ZWN0OiBjaGlsZERpY3RzIGZvcktleTpXZWJDaGlsZHJlbktleV07CiAgICAgfQo= 24980 2008-11-07 17:11:58 -0800 2008-11-10 14:42:42 -0800 Same patch as before, but with a bit more whitespace and a ChangeLog... patch2.txt text/plain 1142 agolden SW5kZXg6IFdlYktpdC9tYWMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYktpdC9tYWMvQ2hh bmdlTG9nCShyZXZpc2lvbiAzODIzMikKKysrIFdlYktpdC9tYWMvQ2hhbmdlTG9nCSh3b3JraW5n IGNvcHkpCkBAIC0xLDMgKzEsMTAgQEAKKzIwMDgtMTEtMDcgIEFhcm9uIEdvbGRlbiAgPGFnb2xk ZW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgICogSGlzdG9yeS9XZWJIaXN0b3J5SXRlbS5tbToKKyAgICAgICAgKC1bV2ViSGlzdG9y eUl0ZW0gZGljdGlvbmFyeVJlcHJlc2VudGF0aW9uXSk6CisKIDIwMDgtMTEtMDYgIEFuZGVycyBD YXJsc3NvbiAgPGFuZGVyc2NhQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBLZXZp biBEZWNrZXIuCkluZGV4OiBXZWJLaXQvbWFjL0hpc3RvcnkvV2ViSGlzdG9yeUl0ZW0ubW0KPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gV2ViS2l0L21hYy9IaXN0b3J5L1dlYkhpc3RvcnlJdGVtLm1tCShyZXZpc2lv biAzODIzMikKKysrIFdlYktpdC9tYWMvSGlzdG9yeS9XZWJIaXN0b3J5SXRlbS5tbQkod29ya2lu ZyBjb3B5KQpAQCAtNDEwLDcgKzQxMCw3IEBACiAgICAgICAgIGNvbnN0IEhpc3RvcnlJdGVtVmVj dG9yJiBjaGlsZHJlbiA9IGNvcmVJdGVtLT5jaGlsZHJlbigpOwogICAgICAgICBOU011dGFibGVB cnJheSAqY2hpbGREaWN0cyA9IFtOU011dGFibGVBcnJheSBhcnJheVdpdGhDYXBhY2l0eTpjaGls ZHJlbi5zaXplKCldOwogICAgICAgICAKLSAgICAgICAgZm9yIChpbnQgaSA9IGNoaWxkcmVuLnNp emUoKTsgaSA+PSAwOyBpLS0pCisgICAgICAgIGZvciAoaW50IGkgPSBjaGlsZHJlbi5zaXplKCkg LSAxOyBpID49IDA7IGktLSkKICAgICAgICAgICAgIFtjaGlsZERpY3RzIGFkZE9iamVjdDpba2l0 KGNoaWxkcmVuW2ldLmdldCgpKSBkaWN0aW9uYXJ5UmVwcmVzZW50YXRpb25dXTsKICAgICAgICAg W2RpY3Qgc2V0T2JqZWN0OiBjaGlsZERpY3RzIGZvcktleTpXZWJDaGlsZHJlbktleV07CiAgICAg fQo= 25025 2008-11-10 12:42:30 -0800 2008-11-11 09:24:43 -0800 New patch patch3.txt text/plain 1652 agolden SW5kZXg6IFdlYktpdC9tYWMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYktpdC9tYWMvQ2hh bmdlTG9nCShyZXZpc2lvbiAzODI2OCkKKysrIFdlYktpdC9tYWMvQ2hhbmdlTG9nCSh3b3JraW5n IGNvcHkpCkBAIC0xLDMgKzEsMTEgQEAKKzIwMDgtMTEtMTAgIEFhcm9uIEdvbGRlbiAgPGFnb2xk ZW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgICogSGlzdG9yeS9XZWJIaXN0b3J5SXRlbS5tbToKKyAgICAgICAgKC1bV2ViSGlzdG9y eUl0ZW0gaW5pdEZyb21EaWN0aW9uYXJ5UmVwcmVzZW50YXRpb246XSk6CisgICAgICAgICgtW1dl Ykhpc3RvcnlJdGVtIGRpY3Rpb25hcnlSZXByZXNlbnRhdGlvbl0pOgorCiAyMDA4LTExLTEwICBB bmRlcnMgQ2FybHNzb24gIDxhbmRlcnNjYUBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQg YnkgQWRhbSBSb2Jlbi4KSW5kZXg6IFdlYktpdC9tYWMvSGlzdG9yeS9XZWJIaXN0b3J5SXRlbS5t bQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBXZWJLaXQvbWFjL0hpc3RvcnkvV2ViSGlzdG9yeUl0ZW0ubW0JKHJl dmlzaW9uIDM4MjY4KQorKysgV2ViS2l0L21hYy9IaXN0b3J5L1dlYkhpc3RvcnlJdGVtLm1tCSh3 b3JraW5nIGNvcHkpCkBAIC0zNTIsNyArMzUyLDcgQEAKIAogICAgIE5TQXJyYXkgKmNoaWxkRGlj dHMgPSBbZGljdCBvYmplY3RGb3JLZXk6V2ViQ2hpbGRyZW5LZXldOwogICAgIGlmIChjaGlsZERp Y3RzKSB7Ci0gICAgICAgIGZvciAoaW50IGkgPSBbY2hpbGREaWN0cyBjb3VudF07IGkgPj0gMDsg aS0tKSB7CisgICAgICAgIGZvciAoaW50IGkgPSBbY2hpbGREaWN0cyBjb3VudF0gLSAxOyBpID49 IDA7IGktLSkgewogICAgICAgICAgICAgV2ViSGlzdG9yeUl0ZW0gKmNoaWxkID0gW1tXZWJIaXN0 b3J5SXRlbSBhbGxvY10gaW5pdEZyb21EaWN0aW9uYXJ5UmVwcmVzZW50YXRpb246IFtjaGlsZERp Y3RzIG9iamVjdEF0SW5kZXg6aV1dOwogICAgICAgICAgICAgY29yZShfcHJpdmF0ZSktPmFkZENo aWxkSXRlbShjb3JlKGNoaWxkLT5fcHJpdmF0ZSkpOwogICAgICAgICAgICAgW2NoaWxkIHJlbGVh c2VdOwpAQCAtNDEwLDcgKzQxMCw3IEBACiAgICAgICAgIGNvbnN0IEhpc3RvcnlJdGVtVmVjdG9y JiBjaGlsZHJlbiA9IGNvcmVJdGVtLT5jaGlsZHJlbigpOwogICAgICAgICBOU011dGFibGVBcnJh eSAqY2hpbGREaWN0cyA9IFtOU011dGFibGVBcnJheSBhcnJheVdpdGhDYXBhY2l0eTpjaGlsZHJl bi5zaXplKCldOwogICAgICAgICAKLSAgICAgICAgZm9yIChpbnQgaSA9IGNoaWxkcmVuLnNpemUo KTsgaSA+PSAwOyBpLS0pCisgICAgICAgIGZvciAoaW50IGkgPSBjaGlsZHJlbi5zaXplKCkgLSAx OyBpID49IDA7IGktLSkKICAgICAgICAgICAgIFtjaGlsZERpY3RzIGFkZE9iamVjdDpba2l0KGNo aWxkcmVuW2ldLmdldCgpKSBkaWN0aW9uYXJ5UmVwcmVzZW50YXRpb25dXTsKICAgICAgICAgW2Rp Y3Qgc2V0T2JqZWN0OiBjaGlsZERpY3RzIGZvcktleTpXZWJDaGlsZHJlbktleV07CiAgICAgfQo=