54737 2011-02-18 03:08:48 -0800 Memory allocation error in convertV8ObjectToNPVariant() for strings 2011-02-18 04:27:58 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 steveblock webkit-unassigned japhet steveblock oldest_to_newest 353510 0 steveblock 2011-02-18 03:08:48 -0800 http://trac.webkit.org/changeset/76264 modified convertV8ObjectToNPVariant() to use malloc() and memcpy() rather than strdup(). This introduced a crashing bug as the null terminator is not included in the length used to allocate memory and copy the string. 353521 1 82941 steveblock 2011-02-18 04:16:31 -0800 Created attachment 82941 Patch 353524 2 82941 kling 2011-02-18 04:23:55 -0800 Comment on attachment 82941 Patch LGTM. 353525 3 steveblock 2011-02-18 04:27:58 -0800 Committed r78994: <http://trac.webkit.org/changeset/78994> 82941 2011-02-18 04:16:31 -0800 2011-02-18 04:23:55 -0800 Patch bug-54737-20110218121629.patch text/plain 1759 steveblock SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDc4OTkxKQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTEtMDItMTggIFN0ZXZlIEJs b2NrICA8c3RldmVibG9ja0Bnb29nbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIE1lbW9yeSBhbGxvY2F0aW9uIGVycm9yIGluIGNvbnZlcnRW OE9iamVjdFRvTlBWYXJpYW50KCkgZm9yIHN0cmluZ3MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU0NzM3CisKKyAgICAgICAgSW5jbHVkZSB0aGUgdGVy bWluYXRpb24gY2hhcmFjdGVyIGluIHRoZSBsZW5ndGggd2hlbiBhbGxvY2F0aW5nIG1lbW9yeQor ICAgICAgICBhbmQgY29weWluZyB0aGUgc3RyaW5nLiBUaGlzIGZpeGVzIGEgY3Jhc2hpbmcgYnVn IG9uIEFuZHJvaWQuCisKKyAgICAgICAgVGhpcyBzaG91bGQgYmUgdGVzdGVkIGJ5IHRoZSBqYXZh LyB0ZXN0cyBvbiBDaHJvbWl1bSwgYnV0IHRoZXNlCisgICAgICAgIHRlc3RzIGFyZSBjdXJyZW50 bHkgc2tpcHBlZC4KKworICAgICAgICAqIGJpbmRpbmdzL3Y4L1Y4TlBVdGlscy5jcHA6CisgICAg ICAgIChXZWJDb3JlOjpjb252ZXJ0VjhPYmplY3RUb05QVmFyaWFudCk6CisKIDIwMTEtMDItMTgg IFBoaWxpcHBlIE5vcm1hbmQgIDxwbm9ybWFuZEBpZ2FsaWEuY29tPgogCiAgICAgICAgIFVucmV2 aWV3ZWQsIHJvbGxpbmcgb3V0IHI3ODk3OS4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2JpbmRpbmdz L3Y4L1Y4TlBVdGlscy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvYmluZGluZ3Mv djgvVjhOUFV0aWxzLmNwcAkocmV2aXNpb24gNzg5OTEpCisrKyBTb3VyY2UvV2ViQ29yZS9iaW5k aW5ncy92OC9WOE5QVXRpbHMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC02Myw4ICs2Myw5IEBAIHZv aWQgY29udmVydFY4T2JqZWN0VG9OUFZhcmlhbnQodjg6OkxvY2EKICAgICAgICAgVk9JRF9UT19O UFZBUklBTlQoKnJlc3VsdCk7CiAgICAgZWxzZSBpZiAob2JqZWN0LT5Jc1N0cmluZygpKSB7CiAg ICAgICAgIHY4OjpTdHJpbmc6OlV0ZjhWYWx1ZSB1dGY4KG9iamVjdCk7Ci0gICAgICAgIGNoYXIq IHV0ZjhDaGFycyA9IHJlaW50ZXJwcmV0X2Nhc3Q8Y2hhcio+KG1hbGxvYyh1dGY4Lmxlbmd0aCgp KSk7Ci0gICAgICAgIG1lbWNweSh1dGY4Q2hhcnMsICp1dGY4LCB1dGY4Lmxlbmd0aCgpKTsKKyAg ICAgICAgaW50IGxlbmd0aCA9IHV0ZjgubGVuZ3RoKCkgKyAxOworICAgICAgICBjaGFyKiB1dGY4 Q2hhcnMgPSByZWludGVycHJldF9jYXN0PGNoYXIqPihtYWxsb2MobGVuZ3RoKSk7CisgICAgICAg IG1lbWNweSh1dGY4Q2hhcnMsICp1dGY4LCBsZW5ndGgpOwogICAgICAgICBTVFJJTkdOX1RPX05Q VkFSSUFOVCh1dGY4Q2hhcnMsIHV0ZjgubGVuZ3RoKCksICpyZXN1bHQpOwogICAgIH0gZWxzZSBp ZiAob2JqZWN0LT5Jc09iamVjdCgpKSB7CiAgICAgICAgIERPTVdpbmRvdyogd2luZG93ID0gVjhQ cm94eTo6cmV0cmlldmVXaW5kb3coVjhQcm94eTo6Y3VycmVudENvbnRleHQoKSk7Cg==