223718 2021-03-24 16:48:27 -0700 Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107:33: runtime error: signed integer overflow: 268435455 * 16 cannot be represented in type 'int' 2021-03-25 11:22:16 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=176131 InRadar P2 Normal --- 1 cdumez cdumez darin ggaren sam webkit-bug-importer oldest_to_newest 1743600 0 cdumez 2021-03-24 16:48:27 -0700 Fix issue found by UBSan under consumeCharacterReference() in CharacterReferenceParserInlines.h. 1743602 1 424201 cdumez 2021-03-24 16:50:24 -0700 Created attachment 424201 Patch 1743826 2 424201 darin 2021-03-25 10:59:54 -0700 Comment on attachment 424201 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424201&action=review > Source/WebCore/ChangeLog:9 > + Use Checked<> for the result in consumeCharacterReference() to deal with overflows > + in a well-defined manner. The reason UBSan doesn’t like this is that we don’t stop doing the worthless calculations once we have overflowed. Otherwise the code was fine. > Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107 > + result += static_cast<UChar32>(toASCIIHexValue(character)); Surprised that we need a typecast here; would have tried to avoid it. 1743841 3 ews-feeder 2021-03-25 11:21:03 -0700 Committed r275048: <https://commits.webkit.org/r275048> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424201. 1743843 4 webkit-bug-importer 2021-03-25 11:22:16 -0700 <rdar://problem/75845102> 424201 2021-03-24 16:50:24 -0700 2021-03-25 11:21:04 -0700 Patch bug-223718-20210324165023.patch text/plain 4103 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0OTgzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWI2ZDQwZTBjMTA2NjRm YjgzZDQyOWIwM2E2ODgzNzdjZTM3NjAwYS4uOTVhZTYyMmU5Yzc3ODA5ZWU0YzEyMjdkZDNmN2Ji MjU4ZjQ0YWM3NSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIxLTAzLTI0ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgU291cmNlL1dlYkNvcmUveG1s L3BhcnNlci9DaGFyYWN0ZXJSZWZlcmVuY2VQYXJzZXJJbmxpbmVzLmg6MTA3OjMzOiBydW50aW1l IGVycm9yOiBzaWduZWQgaW50ZWdlciBvdmVyZmxvdzogMjY4NDM1NDU1ICogMTYgY2Fubm90IGJl IHJlcHJlc2VudGVkIGluIHR5cGUgJ2ludCcKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTIyMzcxOAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIFVzZSBDaGVja2VkPD4gZm9yIHRoZSByZXN1bHQgaW4gY29uc3Vt ZUNoYXJhY3RlclJlZmVyZW5jZSgpIHRvIGRlYWwgd2l0aCBvdmVyZmxvd3MKKyAgICAgICAgaW4g YSB3ZWxsLWRlZmluZWQgbWFubmVyLgorCisgICAgICAgICogeG1sL3BhcnNlci9DaGFyYWN0ZXJS ZWZlcmVuY2VQYXJzZXJJbmxpbmVzLmg6CisgICAgICAgIChXZWJDb3JlOjpjb25zdW1lQ2hhcmFj dGVyUmVmZXJlbmNlKToKKwogMjAyMS0wMy0yNCAgRXJpYyBDYXJsc29uICA8ZXJpYy5jYXJsc29u QGFwcGxlLmNvbT4KIAogICAgICAgICBbQ29jb2FdIEFkZCBFeHBlcmltZW50YWwgTWVkaWFTZXNz aW9uIGNvb3JkaW5hdG9yCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS94bWwvcGFyc2VyL0No YXJhY3RlclJlZmVyZW5jZVBhcnNlcklubGluZXMuaCBiL1NvdXJjZS9XZWJDb3JlL3htbC9wYXJz ZXIvQ2hhcmFjdGVyUmVmZXJlbmNlUGFyc2VySW5saW5lcy5oCmluZGV4IDBhNDY1ZmIxZjQ0ZTli ZDBlYzM4NjU1YzZmMTFmZmIzYmE5MTQwN2MuLjMwOGFkNTZkMjQ0YTcwYjY5YzhiZTI1YTk2MmE4 MDMzODM4ODczM2UgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3htbC9wYXJzZXIvQ2hhcmFj dGVyUmVmZXJlbmNlUGFyc2VySW5saW5lcy5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL3htbC9wYXJz ZXIvQ2hhcmFjdGVyUmVmZXJlbmNlUGFyc2VySW5saW5lcy5oCkBAIC01MSw4ICs1MSw3IEBAIGJv b2wgY29uc3VtZUNoYXJhY3RlclJlZmVyZW5jZShTZWdtZW50ZWRTdHJpbmcmIHNvdXJjZSwgU3Ry aW5nQnVpbGRlciYgZGVjb2RlZENoCiAgICAgICAgIERlY2ltYWwsCiAgICAgICAgIE5hbWVkCiAg ICAgfSBzdGF0ZSA9IEluaXRpYWw7Ci0gICAgVUNoYXIzMiByZXN1bHQgPSAwOwotICAgIGJvb2wg b3ZlcmZsb3cgPSBmYWxzZTsKKyAgICBDaGVja2VkPFVDaGFyMzIsIFJlY29yZE92ZXJmbG93PiBy ZXN1bHQgPSAwOwogICAgIFN0cmluZ0J1aWxkZXIgY29uc3VtZWRDaGFyYWN0ZXJzOwogICAgIAog ICAgIHdoaWxlICghc291cmNlLmlzRW1wdHkoKSkgewpAQCAtMTA0LDE4ICsxMDMsMTcgQEAgYm9v bCBjb25zdW1lQ2hhcmFjdGVyUmVmZXJlbmNlKFNlZ21lbnRlZFN0cmluZyYgc291cmNlLCBTdHJp bmdCdWlsZGVyJiBkZWNvZGVkQ2gKICAgICAgICAgY2FzZSBIZXg6CiAgICAgICAgIEhleDoKICAg ICAgICAgICAgIGlmIChpc0FTQ0lJSGV4RGlnaXQoY2hhcmFjdGVyKSkgewotICAgICAgICAgICAg ICAgIHJlc3VsdCA9IHJlc3VsdCAqIDE2ICsgdG9BU0NJSUhleFZhbHVlKGNoYXJhY3Rlcik7Ci0g ICAgICAgICAgICAgICAgaWYgKHJlc3VsdCA+IFVDSEFSX01BWF9WQUxVRSkKLSAgICAgICAgICAg ICAgICAgICAgb3ZlcmZsb3cgPSB0cnVlOworICAgICAgICAgICAgICAgIHJlc3VsdCAqPSAxNjsK KyAgICAgICAgICAgICAgICByZXN1bHQgKz0gc3RhdGljX2Nhc3Q8VUNoYXIzMj4odG9BU0NJSUhl eFZhbHVlKGNoYXJhY3RlcikpOwogICAgICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAg fQogICAgICAgICAgICAgaWYgKGNoYXJhY3RlciA9PSAnOycpIHsKICAgICAgICAgICAgICAgICBz b3VyY2UuYWR2YW5jZVBhc3ROb25OZXdsaW5lKCk7Ci0gICAgICAgICAgICAgICAgZGVjb2RlZENo YXJhY3Rlci5hcHBlbmRDaGFyYWN0ZXIoUGFyc2VyRnVuY3Rpb25zOjpsZWdhbEVudGl0eUZvcihv dmVyZmxvdyA/IDAgOiByZXN1bHQpKTsKKyAgICAgICAgICAgICAgICBkZWNvZGVkQ2hhcmFjdGVy LmFwcGVuZENoYXJhY3RlcihQYXJzZXJGdW5jdGlvbnM6OmxlZ2FsRW50aXR5Rm9yKHJlc3VsdC5o YXNPdmVyZmxvd2VkKCkgPyAwIDogcmVzdWx0LnVuc2FmZUdldCgpKSk7CiAgICAgICAgICAgICAg ICAgcmV0dXJuIHRydWU7CiAgICAgICAgICAgICB9CiAgICAgICAgICAgICBpZiAoUGFyc2VyRnVu Y3Rpb25zOjphY2NlcHRNYWxmb3JtZWQoKSkgewotICAgICAgICAgICAgICAgIGRlY29kZWRDaGFy YWN0ZXIuYXBwZW5kQ2hhcmFjdGVyKFBhcnNlckZ1bmN0aW9uczo6bGVnYWxFbnRpdHlGb3Iob3Zl cmZsb3cgPyAwIDogcmVzdWx0KSk7CisgICAgICAgICAgICAgICAgZGVjb2RlZENoYXJhY3Rlci5h cHBlbmRDaGFyYWN0ZXIoUGFyc2VyRnVuY3Rpb25zOjpsZWdhbEVudGl0eUZvcihyZXN1bHQuaGFz T3ZlcmZsb3dlZCgpID8gMCA6IHJlc3VsdC51bnNhZmVHZXQoKSkpOwogICAgICAgICAgICAgICAg IHJldHVybiB0cnVlOwogICAgICAgICAgICAgfQogICAgICAgICAgICAgdW5jb25zdW1lQ2hhcmFj dGVycyhzb3VyY2UsIGNvbnN1bWVkQ2hhcmFjdGVycyk7CkBAIC0xMjMsMTggKzEyMSwxNyBAQCBi b29sIGNvbnN1bWVDaGFyYWN0ZXJSZWZlcmVuY2UoU2VnbWVudGVkU3RyaW5nJiBzb3VyY2UsIFN0 cmluZ0J1aWxkZXImIGRlY29kZWRDaAogICAgICAgICBjYXNlIERlY2ltYWw6CiAgICAgICAgIERl Y2ltYWw6CiAgICAgICAgICAgICBpZiAoaXNBU0NJSURpZ2l0KGNoYXJhY3RlcikpIHsKLSAgICAg ICAgICAgICAgICByZXN1bHQgPSByZXN1bHQgKiAxMCArIGNoYXJhY3RlciAtICcwJzsKLSAgICAg ICAgICAgICAgICBpZiAocmVzdWx0ID4gVUNIQVJfTUFYX1ZBTFVFKQotICAgICAgICAgICAgICAg ICAgICBvdmVyZmxvdyA9IHRydWU7CisgICAgICAgICAgICAgICAgcmVzdWx0ICo9IDEwOworICAg ICAgICAgICAgICAgIHJlc3VsdCArPSAoY2hhcmFjdGVyIC0gJzAnKTsKICAgICAgICAgICAgICAg ICBicmVhazsKICAgICAgICAgICAgIH0KICAgICAgICAgICAgIGlmIChjaGFyYWN0ZXIgPT0gJzsn KSB7CiAgICAgICAgICAgICAgICAgc291cmNlLmFkdmFuY2VQYXN0Tm9uTmV3bGluZSgpOwotICAg ICAgICAgICAgICAgIGRlY29kZWRDaGFyYWN0ZXIuYXBwZW5kQ2hhcmFjdGVyKFBhcnNlckZ1bmN0 aW9uczo6bGVnYWxFbnRpdHlGb3Iob3ZlcmZsb3cgPyAwIDogcmVzdWx0KSk7CisgICAgICAgICAg ICAgICAgZGVjb2RlZENoYXJhY3Rlci5hcHBlbmRDaGFyYWN0ZXIoUGFyc2VyRnVuY3Rpb25zOjps ZWdhbEVudGl0eUZvcihyZXN1bHQuaGFzT3ZlcmZsb3dlZCgpID8gMCA6IHJlc3VsdC51bnNhZmVH ZXQoKSkpOwogICAgICAgICAgICAgICAgIHJldHVybiB0cnVlOwogICAgICAgICAgICAgfQogICAg ICAgICAgICAgaWYgKFBhcnNlckZ1bmN0aW9uczo6YWNjZXB0TWFsZm9ybWVkKCkpIHsKLSAgICAg ICAgICAgICAgICBkZWNvZGVkQ2hhcmFjdGVyLmFwcGVuZENoYXJhY3RlcihQYXJzZXJGdW5jdGlv bnM6OmxlZ2FsRW50aXR5Rm9yKG92ZXJmbG93ID8gMCA6IHJlc3VsdCkpOworICAgICAgICAgICAg ICAgIGRlY29kZWRDaGFyYWN0ZXIuYXBwZW5kQ2hhcmFjdGVyKFBhcnNlckZ1bmN0aW9uczo6bGVn YWxFbnRpdHlGb3IocmVzdWx0Lmhhc092ZXJmbG93ZWQoKSA/IDAgOiByZXN1bHQudW5zYWZlR2V0 KCkpKTsKICAgICAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICAgICAgICAgIH0KICAgICAg ICAgICAgIHVuY29uc3VtZUNoYXJhY3RlcnMoc291cmNlLCBjb25zdW1lZENoYXJhY3RlcnMpOwo=