51431 2010-12-21 16:25:19 -0800 -[WebBasePluginPackage isNativeLibraryData:] integer overflows on zero-sized data 2010-12-23 10:39:31 -0800 1 1 1 Unclassified WebKit Plug-ins 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED InRadar P2 Normal --- 1 zwarich zwarich rcombs oldest_to_newest 325256 0 zwarich 2010-12-21 16:25:19 -0800 This is due to bug 51144. 325257 1 zwarich 2010-12-21 16:26:53 -0800 <rdar://problem/8791757> 325258 2 77163 zwarich 2010-12-21 16:28:57 -0800 Created attachment 77163 Proposed path 325264 3 77163 darin 2010-12-21 16:37:03 -0800 Comment on attachment 77163 Proposed path View in context: https://bugs.webkit.org/attachment.cgi?id=77163&action=review > WebKit/mac/Plugins/WebBasePluginPackage.mm:358 > + if (!sizeInBytes) > + return NO; > + > Vector<uint32_t, 128> rawData((sizeInBytes - 1) / 4 + 1); I would suggest just using (sizeInBytes + 3) / 4 rather than adding this null check. 325276 4 zwarich 2010-12-21 17:04:02 -0800 Thanks, that sounds better. 325319 5 zwarich 2010-12-21 18:16:32 -0800 Fixed in r74446. 326149 6 ap 2010-12-23 10:39:31 -0800 *** Bug 51519 has been marked as a duplicate of this bug. *** 77163 2010-12-21 16:28:57 -0800 2010-12-21 16:37:03 -0800 Proposed path overflow.patch text/plain 1280 zwarich SW5kZXg6IFdlYktpdC9tYWMvUGx1Z2lucy9XZWJCYXNlUGx1Z2luUGFja2FnZS5tbQo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBXZWJLaXQvbWFjL1BsdWdpbnMvV2ViQmFzZVBsdWdpblBhY2thZ2UubW0JKHJldmlz aW9uIDc0NDI3KQorKysgV2ViS2l0L21hYy9QbHVnaW5zL1dlYkJhc2VQbHVnaW5QYWNrYWdlLm1t CSh3b3JraW5nIGNvcHkpCkBAIC0zNTIsNiArMzUyLDkgQEAKIC0gKEJPT0wpaXNOYXRpdmVMaWJy YXJ5RGF0YTooTlNEYXRhICopZGF0YQogewogICAgIE5TVUludGVnZXIgc2l6ZUluQnl0ZXMgPSBb ZGF0YSBsZW5ndGhdOworICAgIGlmICghc2l6ZUluQnl0ZXMpCisgICAgICAgIHJldHVybiBOTzsK KwogICAgIFZlY3Rvcjx1aW50MzJfdCwgMTI4PiByYXdEYXRhKChzaXplSW5CeXRlcyAtIDEpIC8g NCArIDEpOwogICAgIG1lbWNweShyYXdEYXRhLmRhdGEoKSwgW2RhdGEgYnl0ZXNdLCBzaXplSW5C eXRlcyk7CiAgICAgCkluZGV4OiBXZWJLaXQvbWFjL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBX ZWJLaXQvbWFjL0NoYW5nZUxvZwkocmV2aXNpb24gNzQ0MzUpCisrKyBXZWJLaXQvbWFjL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDEwLTEyLTIxICBDYW1lcm9u IFp3YXJpY2ggIDx6d2FyaWNoQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICAtW1dlYkJhc2VQbHVnaW5QYWNrYWdlIGlzTmF0aXZlTGli cmFyeURhdGE6XSBpbnRlZ2VyIG92ZXJmbG93cyBvbiB6ZXJvLXNpemVkIGRhdGEKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTUxNDMxCisgICAgICAgIDxy ZGFyOi8vcHJvYmxlbS84NzkxNzU3PgorCisgICAgICAgICogUGx1Z2lucy9XZWJCYXNlUGx1Z2lu UGFja2FnZS5tbToKKyAgICAgICAgKC1bV2ViQmFzZVBsdWdpblBhY2thZ2UgaXNOYXRpdmVMaWJy YXJ5RGF0YTpdKTogUmV0dXJuIE5PIGlmIHRoZSBkYXRhIGhhcyBhIHplcm8KKyAgICAgICAgc2l6 ZSwgYXMgdGhhdCBpcyB3aGF0IHRoZSBmb2xsb3dpbmcgY2hlY2tzIGRvIGFueXdheXMuCisKIDIw MTAtMTItMTYgIFJ5b3N1a2UgTml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CiAKICAgICAgICAgUmV2 aWV3ZWQgYnkgQ2FtZXJvbiBad2FyaWNoLgo=