65211 2011-07-26 15:34:17 -0700 Buffer overflow creating error messages for JSON.parse 2011-07-27 11:18:35 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 oliver oliver oldest_to_newest 442575 0 oliver 2011-07-26 15:34:17 -0700 Buffer overflow creating error messages for JSON.parse 442576 1 102063 oliver 2011-07-26 15:35:26 -0700 Created attachment 102063 Patch 442584 2 oliver 2011-07-26 15:48:15 -0700 Committed r91795: <http://trac.webkit.org/changeset/91795> 442585 3 102063 evan 2011-07-26 15:48:32 -0700 Comment on attachment 102063 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=102063&action=review > Source/JavaScriptCore/ChangeLog:8 > + Parse string length to the UString constructor. Probably meant "Pass", not "Parse", here. 443024 4 oliver 2011-07-27 11:18:04 -0700 <rdar://problem/9835936> 443025 5 oliver 2011-07-27 11:18:35 -0700 This isn't in security because it's a fix for a regression from a day or so ago. 102063 2011-07-26 15:35:26 -0700 2011-07-26 15:48:32 -0700 Patch bug-65211-20110726153525.patch text/plain 3198 oliver U3VidmVyc2lvbiBSZXZpc2lvbjogOTE3NzIKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCAyNjExZGQ2ODBhYzIzZGJiMDM5NmI5 ZDkxODk4ZDc5Mzc4OGZiMDk1Li42ZTY4ZjYyNzk4OWVlZjU2YTEyMjc1NGFkYTllNTAyOTFlM2Uw MTYyIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTEtMDctMjYgIE9saXZlciBIdW50ICA8b2xp dmVyQGFwcGxlLmNvbT4KKworICAgICAgICBCdWZmZXIgb3ZlcmZsb3cgY3JlYXRpbmcgZXJyb3Ig bWVzc2FnZXMgZm9yIEpTT04ucGFyc2UKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTY1MjExCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgVXBkYXRlIHRlc3RjYXNlIHRvIHJlZmxlY3QgYWN0dWFsIGV4cGVjdGVk IG91dHB1dC4KKworICAgICAgICAqIGZhc3QvanMvSlNPTi1wYXJzZS1leHBlY3RlZC50eHQ6CisK IDIwMTEtMDctMjYgIEFkcmllbm5lIFdhbGtlciAgPGVubmVAZ29vZ2xlLmNvbT4KIAogICAgICAg ICBbY2hyb21pdW1dIE1hcmsgdGVzdCBhcyBmbGFreSBhZnRlciByOTE3MzguCmRpZmYgLS1naXQg YS9MYXlvdXRUZXN0cy9mYXN0L2pzL0pTT04tcGFyc2UtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVz dHMvZmFzdC9qcy9KU09OLXBhcnNlLWV4cGVjdGVkLnR4dAppbmRleCA5MmQ4ZmMzMTAwYjNlM2Yz MTZjMGYyZTdmZWQ0YTU3ZGJhZjg1MGRkLi5lMWMyM2ZjOGVhMzQyNDhkNDY1MGUzNmViYTgzM2Nk ODkyZWYwZjcxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9mYXN0L2pzL0pTT04tcGFyc2UtZXhw ZWN0ZWQudHh0CisrKyBiL0xheW91dFRlc3RzL2Zhc3QvanMvSlNPTi1wYXJzZS1leHBlY3RlZC50 eHQKQEAgLTE3LDcgKzE3LDcgQEAgUEFTUyBKU09OLnN0cmluZ2lmeSh0ZXN0c1tpXShuYXRpdmVK U09OKSkgaXMgSlNPTi5zdHJpbmdpZnkodGVzdHNbaV0oSlNPTikpCiBmdW5jdGlvbiAoanNvbk9i amVjdCkgewogICAgICAgICByZXR1cm4ganNvbk9iamVjdC5wYXJzZSgnSW5maW5pdHknKTsKICAg ICB9Ci1QQVNTIHRlc3RzW2ldKG5hdGl2ZUpTT04pIHRocmV3IGV4Y2VwdGlvbiBTeW50YXhFcnJv cjogSlNPTiBQYXJzZSBlcnJvcjogVW5leHBlY3RlZCBpZGVudGlmaWVyICJJbmZpbml0eT8iLgor UEFTUyB0ZXN0c1tpXShuYXRpdmVKU09OKSB0aHJldyBleGNlcHRpb24gU3ludGF4RXJyb3I6IEpT T04gUGFyc2UgZXJyb3I6IFVuZXhwZWN0ZWQgaWRlbnRpZmllciAiSW5maW5pdHkiLgogZnVuY3Rp b24gKGpzb25PYmplY3QpIHsKICAgICAgICAgcmV0dXJuIGpzb25PYmplY3QucGFyc2UoJ05hTicp OwogICAgIH0KZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cgYi9T b3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IDhjMTU0NDU4MGE1NTYwYzQ3ZDg0 YmU4YzI2NmI3MGViODZhYjhlNTEuLjIxNGFhZWQyNjgyY2Y1YzYzYjBlN2RlYWFkMDYxNjY3NGU5 ODk3YjIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKKysrIGIv U291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDExLTA3 LTI2ICBPbGl2ZXIgSHVudCAgPG9saXZlckBhcHBsZS5jb20+CisKKyAgICAgICAgQnVmZmVyIG92 ZXJmbG93IGNyZWF0aW5nIGVycm9yIG1lc3NhZ2VzIGZvciBKU09OLnBhcnNlCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02NTIxMQorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFBhcnNlIHN0cmluZyBsZW5ndGgg dG8gdGhlIFVTdHJpbmcgY29uc3RydWN0b3IuCisKKyAgICAgICAgKiBydW50aW1lL0xpdGVyYWxQ YXJzZXIuY3BwOgorICAgICAgICAoSlNDOjpMaXRlcmFsUGFyc2VyOjpwYXJzZSk6CisKIDIwMTEt MDctMjYgIEp1YW4gQy4gTW9udGVtYXlvciAgPGptb250QGFwcGxlLmNvbT4KIAogICAgICAgICBK U09OIGVycm9ycyBzaG91bGQgYmUgaW5mb3JtYXRpdmUKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZh U2NyaXB0Q29yZS9ydW50aW1lL0xpdGVyYWxQYXJzZXIuY3BwIGIvU291cmNlL0phdmFTY3JpcHRD b3JlL3J1bnRpbWUvTGl0ZXJhbFBhcnNlci5jcHAKaW5kZXggOTBiZmVmYjhkYmZjZGExMjRlNDJk ODNmMjVkODMwMzgyMzAzNjA3OS4uNzAwODE2MDNkNWIzNjY0MzU2Mjc0YjhlMDVlYTYwMTI5YjI2 ODc3OSAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvTGl0ZXJhbFBh cnNlci5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvTGl0ZXJhbFBhcnNl ci5jcHAKQEAgLTYwOSw3ICs2MDksNyBAQCBKU1ZhbHVlIExpdGVyYWxQYXJzZXI6OnBhcnNlKFBh cnNlclN0YXRlIGluaXRpYWxTdGF0ZSkKICAgICAgICAgICAgICAgICAgICAgICAgIG1fcGFyc2VF cnJvck1lc3NhZ2UgPSAiVW5leHBlY3RlZCB0b2tlbiAnfSciOwogICAgICAgICAgICAgICAgICAg ICAgICAgcmV0dXJuIEpTVmFsdWUoKTsKICAgICAgICAgICAgICAgICAgICAgY2FzZSBUb2tJZGVu dGlmaWVyOgotICAgICAgICAgICAgICAgICAgICAgICAgbV9wYXJzZUVycm9yTWVzc2FnZSA9IFN0 cmluZzo6Zm9ybWF0KCJVbmV4cGVjdGVkIGlkZW50aWZpZXIgXCIlc1wiIiwgVVN0cmluZyhtX2xl eGVyLmN1cnJlbnRUb2tlbigpLnN0cmluZ1Rva2VuKS5hc2NpaSgpLmRhdGEoKSkuaW1wbCgpOwor ICAgICAgICAgICAgICAgICAgICAgICAgbV9wYXJzZUVycm9yTWVzc2FnZSA9IFN0cmluZzo6Zm9y bWF0KCJVbmV4cGVjdGVkIGlkZW50aWZpZXIgXCIlc1wiIiwgVVN0cmluZyhtX2xleGVyLmN1cnJl bnRUb2tlbigpLnN0cmluZ1Rva2VuLCBtX2xleGVyLmN1cnJlbnRUb2tlbigpLnN0cmluZ0xlbmd0 aCkuYXNjaWkoKS5kYXRhKCkpLmltcGwoKTsKICAgICAgICAgICAgICAgICAgICAgICAgIHJldHVy biBKU1ZhbHVlKCk7CiAgICAgICAgICAgICAgICAgICAgIGNhc2UgVG9rQ29sb246CiAgICAgICAg ICAgICAgICAgICAgICAgICBtX3BhcnNlRXJyb3JNZXNzYWdlID0gIlVuZXhwZWN0ZWQgdG9rZW4g JzonIjsK