223666 2021-03-23 18:57:34 -0700 [YARR] Interpreter incorrectly matches non-BMP characters with multiple . w/dotAll flag 2021-03-24 10:29:05 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff ews-watchlist keith_miller mark.lam saam tzagallo webkit-bug-importer oldest_to_newest 1743112 0 msaboff 2021-03-23 18:57:34 -0700 Similar to the fuzzer bug found in https://bugs.webkit.org/show_bug.cgi?id=223498 - "[YARR] Interpreter incorrectly matches non-BMP characters with multiple .", there is a similar issue when the dotAll flag (s) is used. String.fromCodePoint(0x10000).match(/../u) should not match but does in the Yarr Interpreter. 1743113 1 msaboff 2021-03-23 18:58:06 -0700 <rdar://75730500> 1743115 2 424089 msaboff 2021-03-23 19:02:55 -0700 Created attachment 424089 Patch 1743129 3 424089 mark.lam 2021-03-23 20:01:39 -0700 Comment on attachment 424089 Patch r=me 1743384 4 msaboff 2021-03-24 10:29:05 -0700 Committed r274945 (235702@main): <https://commits.webkit.org/235702@main> 424089 2021-03-23 19:02:55 -0700 2021-03-23 20:01:39 -0700 Patch 223666.patch text/plain 3014 msaboff SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNzQ5MjgpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE0IEBACisyMDIxLTAzLTIzICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBw bGUuY29tPgorCisgICAgICAgIFtZQVJSXSBJbnRlcnByZXRlciBpbmNvcnJlY3RseSBtYXRjaGVz IG5vbi1CTVAgY2hhcmFjdGVycyB3aXRoIG11bHRpcGxlIC4gdy9kb3RBbGwgZmxhZworICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIzNjY2CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkZWQgdGVzdHMgZm9y IGRvdEFsbC4gIEFsc28gbWFkZSBzdXJlIHRoYXQgd2UgdGVzdCBib3RoIEpJVCBhbmQgbm9uLUpJ VCBleGVjdXRpb24uCisKKyAgICAgICAgKiBzdHJlc3MvcmVnZXhwLWRvdC1tYXRjaC1ub25CTVAu anM6CisKIDIwMjEtMDMtMjMgIFJvYmluIE1vcmlzc2V0ICA8cm1vcmlzc2V0QGFwcGxlLmNvbT4K IAogICAgICAgICBPYmplY3QuZnJlZXplKHRoaXMpIGF0IHRoZSBnbG9iYWwgc2NvcGUgY2FuIGxv c2UgYSByZWZlcmVuY2UgdG8gYSBXYXRjaHBvaW50U2V0CkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9y ZWdleHAtZG90LW1hdGNoLW5vbkJNUC5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3RzL3N0cmVzcy9y ZWdleHAtZG90LW1hdGNoLW5vbkJNUC5qcwkocmV2aXNpb24gMjc0ODY5KQorKysgSlNUZXN0cy9z dHJlc3MvcmVnZXhwLWRvdC1tYXRjaC1ub25CTVAuanMJKHdvcmtpbmcgY29weSkKQEAgLTEsMyAr MSw2IEBACisvL0AgcnVuRGVmYXVsdAorLy9AIHJ1bk5vSklUCisKIGZ1bmN0aW9uIHNob3VsZE1h dGNoKHJlZ2V4cCwgc3RyKSB7CiAgICAgbGV0IHJlc3VsdCA9IHJlZ2V4cC50ZXN0KHN0cik7CiAg ICAgaWYgKHJlc3VsdCAhPT0gdHJ1ZSkKQEAgLTE4LDMgKzIxLDEwIEBAIHNob3VsZE1hdGNoKC8u Li8sIHMpOwogc2hvdWxkbnRNYXRjaCgvLi4vdSwgcyk7CiBzaG91bGRudE1hdGNoKC8uLi4vLCBz KTsKIHNob3VsZG50TWF0Y2goLy4uLi91LCBzKTsKKworc2hvdWxkTWF0Y2goLy4vcywgcyk7Citz aG91bGRNYXRjaCgvLi9zdSwgcyk7CitzaG91bGRNYXRjaCgvLi4vcywgcyk7CitzaG91bGRudE1h dGNoKC8uLi9zdSwgcyk7CitzaG91bGRudE1hdGNoKC8uLi4vcywgcyk7CitzaG91bGRudE1hdGNo KC8uLi4vc3UsIHMpOwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNzQ4 NjkpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTYgQEAKKzIwMjEtMDMtMjMgIE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBhcHBs ZS5jb20+CisKKyAgICAgICAgW1lBUlJdIEludGVycHJldGVyIGluY29ycmVjdGx5IG1hdGNoZXMg bm9uLUJNUCBjaGFyYWN0ZXJzIHdpdGggbXVsdGlwbGUgLiB3L2RvdEFsbCBmbGFnCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjM2NjYKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJbiBjaGVja0NoYXJhY3Rl ckNsYXNzRG9udEFkdmFuY2VJbnB1dEZvck5vbkJNUCgpLCB3ZSBuZWVkIHRvIGNoZWNrIGZvciBp bnB1dC5yZWFkQ2hlY2tlZCgpIHJldHVybmluZyAtMQorICAgICAgICBhbmQgcmV0dXJuIHRoYXQg dGhlIGNoYXJhY3RlciBjbGFzcyBkaWRuJ3QgbWF0Y2guCisKKyAgICAgICAgKiB5YXJyL1lhcnJJ bnRlcnByZXRlci5jcHA6CisgICAgICAgIChKU0M6OllhcnI6OkludGVycHJldGVyOjpjaGVja0No YXJhY3RlckNsYXNzRG9udEFkdmFuY2VJbnB1dEZvck5vbkJNUCk6CisKIDIwMjEtMDMtMjIgIFl1 c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBbSlNDXSBKU0N1c3Rv bUdldHRlckZ1bmN0aW9uL0pTQ3VzdG9tU2V0dGVyRnVuY3Rpb24gc2hvdWxkIHVzZSBJZGVudGlm aWVyIGZvciB0aGVpciBmaWVsZApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3lhcnIvWWFy ckludGVycHJldGVyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUveWFy ci9ZYXJySW50ZXJwcmV0ZXIuY3BwCShyZXZpc2lvbiAyNzQ4NjkpCisrKyBTb3VyY2UvSmF2YVNj cmlwdENvcmUveWFyci9ZYXJySW50ZXJwcmV0ZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00MzYs NiArNDM2LDkgQEAgcHVibGljOgogICAgIGJvb2wgY2hlY2tDaGFyYWN0ZXJDbGFzc0RvbnRBZHZh bmNlSW5wdXRGb3JOb25CTVAoQ2hhcmFjdGVyQ2xhc3MqIGNoYXJhY3RlckNsYXNzLCB1bnNpZ25l ZCBuZWdhdGl2ZUlucHV0T2Zmc2V0KQogICAgIHsKICAgICAgICAgaW50IHJlYWRDaGFyYWN0ZXIg PSBjaGFyYWN0ZXJDbGFzcy0+aGFzT25seU5vbkJNUENoYXJhY3RlcnMoKSA/IGlucHV0LnJlYWRT dXJyb2dhdGVQYWlyQ2hlY2tlZChuZWdhdGl2ZUlucHV0T2Zmc2V0KSA6ICBpbnB1dC5yZWFkQ2hl Y2tlZChuZWdhdGl2ZUlucHV0T2Zmc2V0KTsKKyAgICAgICAgaWYgKHJlYWRDaGFyYWN0ZXIgPCAw KQorICAgICAgICAgICAgcmV0dXJuIGZhbHNlOworCiAgICAgICAgIHJldHVybiB0ZXN0Q2hhcmFj dGVyQ2xhc3MoY2hhcmFjdGVyQ2xhc3MsIHJlYWRDaGFyYWN0ZXIpOwogICAgIH0KIAo=