31138 2009-11-04 12:17:36 -0800 Uninitialized memory read in WebCore::Page::userStyleSheetLocationChanged() 2009-11-04 22:39:55 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 0 dank webkit-unassigned commit-queue oldest_to_newest 160558 0 dank 2009-11-04 12:17:36 -0800 Found via chromium linux layout valgrind bot on LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html . Valgrind complains Invalid read of size 1 at strlen (mc_replace_strmem.c:275) by WebCore::String::fromUTF8(char const*) (String.cpp:682) by WebCore::Page::userStyleSheetLocationChanged() (Page.cpp:545) Address 0xd60f4af is 0 bytes after a block of size 31 alloc'd at malloc (vg_replace_malloc.c:195) ... by WebCore::base64Decode(WTF::Vector<char, 0ul> const&, WTF::Vector<char, 0ul>&) (Base64.cpp:134) by WebCore::Page::userStyleSheetLocationChanged() (Page.cpp:544) Looks like someone forgot to specify a length. I'll attach a fix. 160565 1 42510 dank 2009-11-04 12:22:48 -0800 Created attachment 42510 Supply missing length argument to avoid buffer overrun le voilà! 160640 2 42510 ap 2009-11-04 15:57:34 -0800 Comment on attachment 42510 Supply missing length argument to avoid buffer overrun + * page/Page.cpp: + (WebCore::Page::userStyleSheetLocationChanged): Ideally, there should be per-function comments explaining changes. r=me as is. 160726 3 42510 eric 2009-11-04 22:14:52 -0800 Comment on attachment 42510 Supply missing length argument to avoid buffer overrun I wonder if there are other places we call from UTF8 and need fixes? Since dan's not a committer, adding this to the cq. 160732 4 42510 commit-queue 2009-11-04 22:39:51 -0800 Comment on attachment 42510 Supply missing length argument to avoid buffer overrun Clearing flags on attachment: 42510 Committed r50545: <http://trac.webkit.org/changeset/50545> 160733 5 commit-queue 2009-11-04 22:39:55 -0800 All reviewed patches have been landed. Closing bug. 42510 2009-11-04 12:22:48 -0800 2009-11-04 22:39:51 -0800 Supply missing length argument to avoid buffer overrun webkit31138.patch text/plain 1290 dank SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1MDUyNCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMDktMTEtMDQgIERhbiBLZWdlbCAgPGRhbmtAY2hyb21pdW0ub3Jn PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBi dWZmZXIgb3ZlcnJ1biBpbiBXZWJDb3JlOjpQYWdlOjp1c2VyU3R5bGVTaGVldExvY2F0aW9uQ2hh bmdlZCgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0z MTEzOAorCisgICAgICAgIFRlc3Q6IExheW91dFRlc3RzL3BsYXRmb3JtL21hYy9mYXN0L2xvYWRl ci91c2VyLXN0eWxlc2hlZXQtZmFzdC1wYXRoLmh0bWwgaW4gVmFsZ3JpbmQKKworICAgICAgICAq IHBhZ2UvUGFnZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpQYWdlOjp1c2VyU3R5bGVTaGVldExv Y2F0aW9uQ2hhbmdlZCk6CisKIDIwMDktMTEtMDQgIEtlbGx5IE5vcnRvbiAgPGtub3J0b25AZ29v Z2xlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBQYXZlbCBGZWxkbWFuLgpJbmRleDogV2Vi Q29yZS9wYWdlL1BhZ2UuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvcGFnZS9QYWdlLmNwcAko cmV2aXNpb24gNTA1MTEpCisrKyBXZWJDb3JlL3BhZ2UvUGFnZS5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTU0Miw3ICs1NDIsNyBAQCB2b2lkIFBhZ2U6OnVzZXJTdHlsZVNoZWV0TG9jYXRpb25DaGFu Z2VkCiAKICAgICAgICAgVmVjdG9yPGNoYXI+IHN0eWxlU2hlZXRBc1VURjg7CiAgICAgICAgIGlm IChiYXNlNjREZWNvZGUoZW5jb2RlZERhdGEsIHN0eWxlU2hlZXRBc1VURjgpKQotICAgICAgICAg ICAgbV91c2VyU3R5bGVTaGVldCA9IFN0cmluZzo6ZnJvbVVURjgoc3R5bGVTaGVldEFzVVRGOC5k YXRhKCkpOworICAgICAgICAgICAgbV91c2VyU3R5bGVTaGVldCA9IFN0cmluZzo6ZnJvbVVURjgo c3R5bGVTaGVldEFzVVRGOC5kYXRhKCksIHN0eWxlU2hlZXRBc1VURjguc2l6ZSgpKTsKICAgICB9 CiAgICAgCiAgICAgZm9yIChGcmFtZSogZnJhbWUgPSBtYWluRnJhbWUoKTsgZnJhbWU7IGZyYW1l ID0gZnJhbWUtPnRyZWUoKS0+dHJhdmVyc2VOZXh0KCkpIHsK