54091 2011-02-09 04:46:35 -0800 [EFL] Possible crash of ewk_frame_contents_set 2011-02-17 08:25:19 -0800 1 1 1 Unclassified WebKit WebKit EFL 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 0 ryuan.choi webkit-unassigned antognolli+webkit commit-queue gyuyoung.kim leandro lucas.de.marchi oldest_to_newest 348159 0 ryuan.choi 2011-02-09 04:46:35 -0800 If ewk_frame_contents_set was called with negative value as contents_size(3rd parameter), Application will be crashed like below. (I just called ewk_frame_contents_set(ewk_view_frame_main_get(app->browser), "hello", -1, NULL, NULL, NULL);) #0 0x02181151 in memcpy () from /lib/tls/i686/cmov/libc.so.6 #1 0x00a0c630 in WebCore::SharedBuffer::append(char const*, unsigned int) () from /workspace/webkit/build2/WebKit/libewebkit.so.0 #2 0x00714973 in _ewk_frame_contents_set_internal(Ewk_Frame_Smart_Data*, char const*, unsigned int, char const*, char const*, char const*, char const*) () from /workspace/webkit/build2/WebKit/libewebkit.so.0 Because contents_size is size_t, Overflow occurred. Although contents_size should be size_t, I believe that it should not be crashed. I think that there are two options. 1) remove contents_size and use strlen(contents). It will change API. 2) choose strlen(contents) if contents_size is zero or bigger than strlen(contents). 349495 1 82070 ryuan.choi 2011-02-10 16:31:27 -0800 Created attachment 82070 Patch 352918 2 82070 commit-queue 2011-02-17 08:25:15 -0800 Comment on attachment 82070 Patch Clearing flags on attachment: 82070 Committed r78833: <http://trac.webkit.org/changeset/78833> 352919 3 commit-queue 2011-02-17 08:25:19 -0800 All reviewed patches have been landed. Closing bug. 82070 2011-02-10 16:31:27 -0800 2011-02-17 08:25:14 -0800 Patch bug-54091-20110211093128.patch text/plain 1452 ryuan.choi SW5kZXg6IFNvdXJjZS9XZWJLaXQvZWZsL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv V2ViS2l0L2VmbC9DaGFuZ2VMb2cJKHJldmlzaW9uIDc4Mjg0KQorKysgU291cmNlL1dlYktpdC9l ZmwvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDItMTAg IFJ5dWFuIENob2kgIDxyeXVhbi5jaG9pQHNhbXN1bmcuY29tPgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFtFRkxdIFBvc3NpYmxlIGNyYXNoIG9mIGV3 a19mcmFtZV9jb250ZW50c19zZXQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTU0MDkxCisKKyAgICAgICAgVXNlIGxlbmd0aCBvZiBjb250ZW50cyBpZiBj b250ZW50c19zaXplIHBhcmFtZXRlciBpcyBiaWdnZXIgdGhhbiBsZW5ndGgKKyAgICAgICAgb2Yg Y29udGVudHMuCisKKyAgICAgICAgKiBld2svZXdrX2ZyYW1lLmNwcDoKKyAgICAgICAgKF9ld2tf ZnJhbWVfY29udGVudHNfc2V0X2ludGVybmFsKToKKwogMjAxMS0wMi0wOCAgQWRhbSBCYXJ0aCAg PGFiYXJ0aEB3ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEVyaWMgU2VpZGVsLgpJ bmRleDogU291cmNlL1dlYktpdC9lZmwvZXdrL2V3a19mcmFtZS5jcHAKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL1dlYktpdC9lZmwvZXdrL2V3a19mcmFtZS5jcHAJKHJldmlzaW9uIDc4MjgxKQorKysg U291cmNlL1dlYktpdC9lZmwvZXdrL2V3a19mcmFtZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTUx MCw4ICs1MTAsOSBAQCBFaW5hX0Jvb2wgZXdrX2ZyYW1lX2NvbnRlbnRzX3NpemVfZ2V0KGNvCiAK IHN0YXRpYyBFaW5hX0Jvb2wgX2V3a19mcmFtZV9jb250ZW50c19zZXRfaW50ZXJuYWwoRXdrX0Zy YW1lX1NtYXJ0X0RhdGEgKnNkLCBjb25zdCBjaGFyKiBjb250ZW50cywgc2l6ZV90IGNvbnRlbnRz X3NpemUsIGNvbnN0IGNoYXIqIG1pbWVfdHlwZSwgY29uc3QgY2hhciogZW5jb2RpbmcsIGNvbnN0 IGNoYXIqIGJhc2VfdXJpLCBjb25zdCBjaGFyKiB1bnJlYWNoYWJsZV91cmkpCiB7Ci0gICAgaWYg KGNvbnRlbnRzX3NpemUgPCAxKQotICAgICAgICBjb250ZW50c19zaXplID0gc3RybGVuKGNvbnRl bnRzKTsKKyAgICBzaXplX3QgbGVuID0gc3RybGVuKGNvbnRlbnRzKTsKKyAgICBpZiAoY29udGVu dHNfc2l6ZSA8IDEgfHwgY29udGVudHNfc2l6ZSA+IGxlbikKKyAgICAgICAgY29udGVudHNfc2l6 ZSA9IGxlbjsKICAgICBpZiAoIW1pbWVfdHlwZSkKICAgICAgICAgbWltZV90eXBlID0gInRleHQv aHRtbCI7CiAgICAgaWYgKCFlbmNvZGluZykK