<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>221773</bug_id>
          
          <creation_ts>2021-02-11 12:51:38 -0800</creation_ts>
          <short_desc>[Cocoa] IPC decoder is using decoded size to allocate memory for an array</short_desc>
          <delta_ts>2021-04-25 10:51:28 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKit2</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=224984</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Darin Adler">darin</reporter>
          <assigned_to name="Darin Adler">darin</assigned_to>
          <cc>ggaren</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1728246</commentid>
    <comment_count>0</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-02-11 12:51:38 -0800</bug_when>
    <thetext>[Cocoa] IPC decoder is using decoded size to allocate memory for an array</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1728247</commentid>
    <comment_count>1</comment_count>
      <attachid>420032</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-02-11 12:53:17 -0800</bug_when>
    <thetext>Created attachment 420032
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1728249</commentid>
    <comment_count>2</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-02-11 12:53:50 -0800</bug_when>
    <thetext>rdar://72808726</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1728252</commentid>
    <comment_count>3</comment_count>
      <attachid>420032</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2021-02-11 13:04:06 -0800</bug_when>
    <thetext>Comment on attachment 420032
Patch

r=me

I wonder if we should honor some safe nominal capacity, like std::min(1024, size), for performance.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1728259</commentid>
    <comment_count>4</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-02-11 13:29:08 -0800</bug_when>
    <thetext>(In reply to Geoffrey Garen from comment #3)
&gt; I wonder if we should honor some safe nominal capacity, like std::min(1024,
&gt; size), for performance.

We don’t do that for CFArray or for vectors, but I agree that it *might* be a valuable optimization for cases like these.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1728261</commentid>
    <comment_count>5</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-02-11 13:30:38 -0800</bug_when>
    <thetext>Committed r272744: &lt;https://trac.webkit.org/changeset/272744&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>420032</attachid>
            <date>2021-02-11 12:53:17 -0800</date>
            <delta_ts>2021-02-11 13:04:06 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-221773-20210211125316.patch</filename>
            <type>text/plain</type>
            <size>1812</size>
            <attacher name="Darin Adler">darin</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyNzM3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No
YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDM0Y2E5MDljN2IzYTYxNWI4
YjU0NTUzYjcyNmQ5ZDZiYzAxODhkMTUuLmUyY2U1MWViNTk2ODRkMjA5NWEwOGViZWMzNDRhNmQ4
MWNhYTFhNzUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj
ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMjEtMDItMTEgIERhcmluIEFk
bGVyICA8ZGFyaW5AYXBwbGUuY29tPgorCisgICAgICAgIFtDb2NvYV0gSVBDIGRlY29kZXIgaXMg
dXNpbmcgZGVjb2RlZCBzaXplIHRvIGFsbG9jYXRlIG1lbW9yeSBmb3IgYW4gYXJyYXkKKyAgICAg
ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMTc3MworCisgICAg
ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogU2hhcmVkL0NvY29h
L0FyZ3VtZW50Q29kZXJzQ29jb2EubW06CisgICAgICAgIChJUEM6OmRlY29kZUFycmF5SW50ZXJu
YWwpOiBBcyB3aXRoIG90aGVyIHNpbWlsYXIgc3RydWN0dXJlcywgc3VjaCBhIFZlY3RvciBhbmQK
KyAgICAgICAgQ0ZBcnJheSwgZG9uJ3QgdXNlIHRoZSBzaXplIHRvIHByZWFsbG9jYXRlIHNwYWNl
IHdoZW4gZGVjb2RpbmcgYW4gTlNBcnJheS4gVGhlCisgICAgICAgIGRlY29kZWQgc2l6ZSBpcyBw
b3RlbnRpYWxseSBpbmNvcnJlY3QsIHdoaWNoIHdlIHdpbGwgZGlzY292ZXIgaW5kaXJlY3RseSB3
aGVuCisgICAgICAgIGRlY29kaW5nIHRoZSBhcnJheSBlbGVtZW50czsgd2UgY2FuJ3Qgc2FmZWx5
IHVzZSB0aGUgc2l6ZSB0byBtYWtlIGEgY2hvaWNlIGFib3V0CisgICAgICAgIGFsbG9jYXRpbmcg
bWVtb3J5IGJlZm9yZWhhbmQuCisKIDIwMjEtMDItMTEgIFlvdWVubiBGYWJsZXQgIDx5b3Vlbm5A
YXBwbGUuY29tPgogCiAgICAgICAgIFtNYWNPU10gRW5hYmxlIEF1ZGlvIENhcHR1cmUgaW4gR1BV
UHJvY2VzcyBieSBkZWZhdWx0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9Db2Nv
YS9Bcmd1bWVudENvZGVyc0NvY29hLm1tIGIvU291cmNlL1dlYktpdC9TaGFyZWQvQ29jb2EvQXJn
dW1lbnRDb2RlcnNDb2NvYS5tbQppbmRleCA3ZDJkZTc2M2FkOGU0NWZmZWFkMzE1YTBmMmRlNDY0
NzhjMDYwYjU0Li5iZDNhZWMzMWMzM2RiNTdmNmY4MjI3ZTM1NjkxYWEzYjg3NDBmODdhIDEwMDY0
NAotLS0gYS9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9Db2NvYS9Bcmd1bWVudENvZGVyc0NvY29hLm1t
CisrKyBiL1NvdXJjZS9XZWJLaXQvU2hhcmVkL0NvY29hL0FyZ3VtZW50Q29kZXJzQ29jb2EubW0K
QEAgLTE3Niw3ICsxNzYsNyBAQCBzdGF0aWMgT3B0aW9uYWw8UmV0YWluUHRyPGlkPj4gZGVjb2Rl
QXJyYXlJbnRlcm5hbChEZWNvZGVyJiBkZWNvZGVyLCBOU0FycmF5PENsYQogICAgIGlmICghZGVj
b2Rlci5kZWNvZGUoc2l6ZSkpCiAgICAgICAgIHJldHVybiBXVEY6Om51bGxvcHQ7CiAKLSAgICBS
ZXRhaW5QdHI8TlNNdXRhYmxlQXJyYXk+IGFycmF5ID0gYWRvcHROUyhbW05TTXV0YWJsZUFycmF5
IGFsbG9jXSBpbml0V2l0aENhcGFjaXR5OnNpemVdKTsKKyAgICBhdXRvIGFycmF5ID0gYWRvcHRO
UyhbW05TTXV0YWJsZUFycmF5IGFsbG9jXSBpbml0XSk7CiAgICAgZm9yICh1aW50NjRfdCBpID0g
MDsgaSA8IHNpemU7ICsraSkgewogICAgICAgICBhdXRvIHZhbHVlID0gZGVjb2RlT2JqZWN0KGRl
Y29kZXIsIGFsbG93ZWRDbGFzc2VzKTsKICAgICAgICAgaWYgKCF2YWx1ZSkK
</data>
<flag name="review"
          id="438423"
          type_id="1"
          status="+"
          setter="ggaren"
    />
          </attachment>
      

    </bug>

</bugzilla>