223663 2021-03-23 17:00:38 -0700 Address undefined behavior found by UBSan in DateMath.h 2021-03-24 10:32:17 -0700 1 1 1 Unclassified WebKit Web Template Framework WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=176131 InRadar P2 Normal --- 1 cdumez cdumez benjamin cmarcelo darin ews-watchlist ggaren sam webkit-bug-importer oldest_to_newest 1743072 0 cdumez 2021-03-23 17:00:38 -0700 Address undefined behavior found in UBSan in DateMath.h: Release/usr/local/include/wtf/DateMath.h:247:39: runtime error: nan is outside the range of representable values of type 'int' Release/usr/local/include/wtf/DateMath.h:221:29: runtime error: nan is outside the range of representable values of type 'int' Release/usr/local/include/wtf/DateMath.h:165:38: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' 1743075 1 424078 cdumez 2021-03-23 17:04:11 -0700 Created attachment 424078 Patch 1743390 2 ews-feeder 2021-03-24 10:31:32 -0700 Committed r274946: <https://commits.webkit.org/r274946> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424078. 1743391 3 webkit-bug-importer 2021-03-24 10:32:17 -0700 <rdar://problem/75791894> 424078 2021-03-23 17:04:11 -0700 2021-03-24 10:31:33 -0700 Patch bug-223663-20210323170410.patch text/plain 3276 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0OTA5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IGNmYzczYWI5YzdiZWUzNDEzMjkxOGE5 NDVhYTQ3NDVkZjM2NDE1ZWUuLmVjZGVhMjQ4ZGI0OGQ0NjU1OGY1ZDhmY2YxZjYwNWIwY2MzOTc2 NGEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMjUgQEAKKzIwMjEtMDMtMjMgIENocmlzIER1bWV6ICA8Y2R1bWV6 QGFwcGxlLmNvbT4KKworICAgICAgICBBZGRyZXNzIHVuZGVmaW5lZCBiZWhhdmlvciBmb3VuZCBi eSBVQlNhbiBpbiBEYXRlTWF0aC5oCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0yMjM2NjMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KKworICAgICAgICBBZGRyZXNzIHVuZGVmaW5lZCBiZWhhdmlvciBmb3VuZCBieSBVQlNhbiBp biBEYXRlTWF0aC5oCisgICAgICAgIFJlbGVhc2UvdXNyL2xvY2FsL2luY2x1ZGUvd3RmL0RhdGVN YXRoLmg6MjQ3OjM5OiBydW50aW1lIGVycm9yOiBuYW4gaXMgb3V0c2lkZSB0aGUgcmFuZ2Ugb2Yg cmVwcmVzZW50YWJsZSB2YWx1ZXMgb2YgdHlwZSAnaW50JworICAgICAgICBSZWxlYXNlL3Vzci9s b2NhbC9pbmNsdWRlL3d0Zi9EYXRlTWF0aC5oOjIyMToyOTogcnVudGltZSBlcnJvcjogbmFuIGlz IG91dHNpZGUgdGhlIHJhbmdlIG9mIHJlcHJlc2VudGFibGUgdmFsdWVzIG9mIHR5cGUgJ2ludCcK KyAgICAgICAgUmVsZWFzZS91c3IvbG9jYWwvaW5jbHVkZS93dGYvRGF0ZU1hdGguaDoxNjU6Mzg6 IHJ1bnRpbWUgZXJyb3I6IHNpZ25lZCBpbnRlZ2VyIG92ZXJmbG93OiAtMjE0NzQ4MzY0OCAtIDEg Y2Fubm90IGJlIHJlcHJlc2VudGVkIGluIHR5cGUgJ2ludCcKKworICAgICAgICAqIHd0Zi9EYXRl TWF0aC5oOgorICAgICAgICAoV1RGOjpkYXlzRnJvbTE5NzBUb1llYXIpOgorICAgICAgICBDYXN0 IHllYXIgdG8gYSBkb3VibGUgKmJlZm9yZSogc3Vic3RyYWN0aW5nIDEgaW5zdGVhZCBvZiAqYWZ0 ZXIqLiBUaGlzIHdvcmtzIGFyb3VuZCB0aGUgZmFjdCB0aGF0IElOVF9NSU4tMSB3b3VsZCBub3QK KyAgICAgICAgZml0IGluIGFuIGludCBhbmQgd291bGQgYmUgdW5kZWZpbmVkIGJlaGF2aW9yLgor CisgICAgICAgIChXVEY6OmRheUluWWVhcik6CisgICAgICAgIChXVEY6Om1zVG9ZZWFyKToKKyAg ICAgICAgRGVhbCB3aXRoIHRoZSBkb3VibGUgcG90ZW50aWFsbHkgYmVpbmcgTmFOIGJlZm9yZSBj YXN0aW5nIHRvIGFuIGludCwgc2luY2UKKyAgICAgICAgY2FzdGluZyBOYU4gdG8gYW4gaW50IHR5 cGUgaGFzIHVuZGVmaW5lZCBiZWhhdmlvci4KKwogMjAyMS0wMy0yMyAgU2FhbSBCYXJhdGkgIDxz YmFyYXRpQGFwcGxlLmNvbT4KIAogICAgICAgICBEb24ndCByZXF1aXJlIFZNX0ZMQUdTX1BFUk1B TkVOVCBvbiB0aGUgc2ltdWxhdG9yIGJ1aWxkcwpkaWZmIC0tZ2l0IGEvU291cmNlL1dURi93dGYv RGF0ZU1hdGguaCBiL1NvdXJjZS9XVEYvd3RmL0RhdGVNYXRoLmgKaW5kZXggMWFjMjk2MTdhMDEx MWUzN2MwMjM5NTI0YWQ4ODYwNzM0ZGQzOTFmYy4uNjA0Mzg1NWUzNTU0ZjkxYzYxYjliNGQ1MWEy NTVhYmZjYjQ0NDFkMiAxMDA2NDQKLS0tIGEvU291cmNlL1dURi93dGYvRGF0ZU1hdGguaAorKysg Yi9Tb3VyY2UvV1RGL3d0Zi9EYXRlTWF0aC5oCkBAIC0xNjIsNyArMTYyLDcgQEAgaW5saW5lIGRv dWJsZSBkYXlzRnJvbTE5NzBUb1llYXIoaW50IHllYXIpCiAgICAgc3RhdGljIGNvbnN0ZXhwciBp bnQgZXhjbHVkZWRMZWFwRGF5c0JlZm9yZTE5NzFCeTEwMFJ1bGUgPSAxOTcwIC8gMTAwOwogICAg IHN0YXRpYyBjb25zdGV4cHIgaW50IGxlYXBEYXlzQmVmb3JlMTk3MUJ5NDAwUnVsZSA9IDE5NzAg LyA0MDA7CiAKLSAgICBjb25zdCBkb3VibGUgeWVhck1pbnVzT25lID0geWVhciAtIDE7CisgICAg Y29uc3QgZG91YmxlIHllYXJNaW51c09uZSA9IHN0YXRpY19jYXN0PGRvdWJsZT4oeWVhcikgLSAx OwogICAgIGNvbnN0IGRvdWJsZSB5ZWFyc1RvQWRkQnk0UnVsZSA9IGZsb29yKHllYXJNaW51c09u ZSAvIDQuMCkgLSBsZWFwRGF5c0JlZm9yZTE5NzFCeTRSdWxlOwogICAgIGNvbnN0IGRvdWJsZSB5 ZWFyc1RvRXhjbHVkZUJ5MTAwUnVsZSA9IGZsb29yKHllYXJNaW51c09uZSAvIDEwMC4wKSAtIGV4 Y2x1ZGVkTGVhcERheXNCZWZvcmUxOTcxQnkxMDBSdWxlOwogICAgIGNvbnN0IGRvdWJsZSB5ZWFy c1RvQWRkQnk0MDBSdWxlID0gZmxvb3IoeWVhck1pbnVzT25lIC8gNDAwLjApIC0gbGVhcERheXNC ZWZvcmUxOTcxQnk0MDBSdWxlOwpAQCAtMjE4LDcgKzIxOCw4IEBAIGlubGluZSBpbnQgZGF5SW5Z ZWFyKGludCB5ZWFyLCBpbnQgbW9udGgsIGludCBkYXkpCiAKIGlubGluZSBpbnQgZGF5SW5ZZWFy KGRvdWJsZSBtcywgaW50IHllYXIpCiB7Ci0gICAgcmV0dXJuIHN0YXRpY19jYXN0PGludD4obXNU b0RheXMobXMpIC0gZGF5c0Zyb20xOTcwVG9ZZWFyKHllYXIpKTsKKyAgICBkb3VibGUgcmVzdWx0 ID0gbXNUb0RheXMobXMpIC0gZGF5c0Zyb20xOTcwVG9ZZWFyKHllYXIpOworICAgIHJldHVybiBz dGQ6OmlzbmFuKHJlc3VsdCkgPyAwIDogc3RhdGljX2Nhc3Q8aW50PihyZXN1bHQpOwogfQogCiBp bmxpbmUgaW50IGRheUluWWVhcihUaW1lQ2xpcHBlZFBvc2l0aXZlTWlsbGlzZWNvbmRzIG1zLCBp bnQgeWVhcikKQEAgLTI0NCw3ICsyNDUsMTAgQEAgaW5saW5lIGRvdWJsZSBkYXRlVG9EYXlzRnJv bTE5NzAoaW50IHllYXIsIGludCBtb250aCwgaW50IGRheSkKIAogaW5saW5lIGludCBtc1RvWWVh cihkb3VibGUgbXMpCiB7Ci0gICAgaW50IGFwcHJveFllYXIgPSBzdGF0aWNfY2FzdDxpbnQ+KGZs b29yKG1zIC8gKG1zUGVyRGF5ICogMzY1LjI0MjUpKSArIDE5NzApOworICAgIGRvdWJsZSBtc0Fz WWVhcnMgPSBzdGQ6OmZsb29yKG1zIC8gKG1zUGVyRGF5ICogMzY1LjI0MjUpKTsKKyAgICBpZiAo c3RkOjppc25hbihtc0FzWWVhcnMpKQorICAgICAgICBtc0FzWWVhcnMgPSAwOworICAgIGludCBh cHByb3hZZWFyID0gc3RhdGljX2Nhc3Q8aW50Pihtc0FzWWVhcnMgKyAxOTcwKTsKICAgICBkb3Vi bGUgbXNGcm9tQXBwcm94WWVhclRvMTk3MCA9IG1zUGVyRGF5ICogZGF5c0Zyb20xOTcwVG9ZZWFy KGFwcHJveFllYXIpOwogICAgIGlmIChtc0Zyb21BcHByb3hZZWFyVG8xOTcwID4gbXMpCiAgICAg ICAgIHJldHVybiBhcHByb3hZZWFyIC0gMTsK