43369 2010-08-02 11:20:36 -0700 WebBackForwardList::forwardListAsImmutableArrayWithLimit can return partly-uninitialized array 2010-08-02 11:41:45 -0700 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) All All RESOLVED FIXED P1 Major --- 1 sullivan sullivan oldest_to_newest 259001 0 sullivan 2010-08-02 11:20:36 -0700 WebBackForwardList::forwardListAsImmutableArrayWithLimit() has incorrect math that can result in it returning an array that is only partly (or not at all) filled in. The offending line is this one: unsigned last = std::min(m_current + limit, static_cast<unsigned>(m_entries.size() - 1)); if m_current + limit is larger than numeric_limits<unsigned>::max(), this expression will return the wrong value, and the subsequent for loop can skip filling in data for some array slots. 259005 1 63242 sullivan 2010-08-02 11:23:24 -0700 Created attachment 63242 Compute "last" a simpler way that doesn't have overflow potential. 259014 2 sullivan 2010-08-02 11:41:45 -0700 Fixed in http://trac.webkit.org/changeset/64480 63242 2010-08-02 11:23:24 -0700 2010-08-02 11:28:20 -0700 Compute "last" a simpler way that doesn't have overflow potential. 43369_patch.txt text/plain 1413 sullivan SW5kZXg6IFdlYktpdDIvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYktpdDIvQ2hhbmdlTG9n CShyZXZpc2lvbiA2NDQ3OCkKKysrIFdlYktpdDIvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTQgQEAKKzIwMTAtMDgtMDIgIEpvaG4gU3VsbGl2YW4gIDxzdWxsaXZhbkBhcHBs ZS5jb20+CisKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTQzMzY5CisgICAgICAgIFdlYkJhY2tGb3J3YXJkTGlzdDo6Zm9yd2FyZExpc3RBc0ltbXV0YWJs ZUFycmF5V2l0aExpbWl0IGNhbiByZXR1cm4gcGFydGx5LXVuaW5pdGlhbGl6ZWQgYXJyYXkKKyAg ICAgICAgCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICog VUlQcm9jZXNzL1dlYkJhY2tGb3J3YXJkTGlzdC5jcHA6CisgICAgICAgIChXZWJLaXQ6OldlYkJh Y2tGb3J3YXJkTGlzdDo6Zm9yd2FyZExpc3RBc0ltbXV0YWJsZUFycmF5V2l0aExpbWl0KToKKyAg ICAgICAgVXNlIGEgc2ltcGxlciBhbmQgY29ycmVjdCBleHByZXNzaW9uIHRvIGRldGVybWluZSAi bGFzdCIuCisKIDIwMTAtMDgtMDIgIEplcmVteSBPcmxvdyAgPGpvcmxvd0BjaHJvbWl1bS5vcmc+ CiAKICAgICAgICAgU3BlY3VsYXRpdmUgcmV2ZXJ0IG9mIDY0NDI1IGR1ZSB0byBDaHJvbWl1bSBp bnN0YWJpbGl0eQpJbmRleDogV2ViS2l0Mi9VSVByb2Nlc3MvV2ViQmFja0ZvcndhcmRMaXN0LmNw cAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBXZWJLaXQyL1VJUHJvY2Vzcy9XZWJCYWNrRm9yd2FyZExpc3QuY3Bw CShyZXZpc2lvbiA2NDQ0MikKKysrIFdlYktpdDIvVUlQcm9jZXNzL1dlYkJhY2tGb3J3YXJkTGlz dC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE5MSw3ICsxOTEsNyBAQCBQYXNzUmVmUHRyPEltbXV0 YWJsZUFycmF5PiBXZWJCYWNrRm9yd2FyCiAgICAgICAgIHJldHVybiBJbW11dGFibGVBcnJheTo6 Y3JlYXRlKCk7CiAKICAgICBBUElPYmplY3QqKiBhcnJheSA9IG5ldyBBUElPYmplY3QqW3NpemVd OwotICAgIHVuc2lnbmVkIGxhc3QgPSBzdGQ6Om1pbihtX2N1cnJlbnQgKyBsaW1pdCwgc3RhdGlj X2Nhc3Q8dW5zaWduZWQ+KG1fZW50cmllcy5zaXplKCkgLSAxKSk7CisgICAgdW5zaWduZWQgbGFz dCA9IG1fY3VycmVudCArIHNpemU7CiAgICAgZm9yICh1bnNpZ25lZCBpID0gbV9jdXJyZW50ICsg MSwgaiA9IDA7IGkgPD0gbGFzdDsgKytpLCArK2opIHsKICAgICAgICAgQVBJT2JqZWN0KiBpdGVt ID0gbV9lbnRyaWVzW2ldLmdldCgpOwogICAgICAgICBpdGVtLT5yZWYoKTsK