| Summary: | Small buffer overflow within initialization | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Stephan Binner <stbinner> | ||||||
| Component: | JavaScriptCore | Assignee: | Alexey Proskuryakov <ap> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | ap, ddkilzer | ||||||
| Priority: | P2 | ||||||||
| Version: | 528+ (Nightly build) | ||||||||
| Hardware: | PC | ||||||||
| OS: | Linux | ||||||||
| Attachments: |
|
||||||||
Wow, thanks for catching this! AFAICT, on the Mac, these structs are the same - is struct tm bigger on Linux? Also, GregorianDateTime is initialized to zero anyway, so we should probably just take out the calls to memset here and elsewhere. Would you be willing to submit this for review as described in <http://webkit.org/coding/contributing.html>? On x86_64 it is. Created attachment 18723 [details]
Same as in original post
Comment on attachment 18723 [details]
Same as in original post
Instead of correcting memset usage, we should just remove it (not just here, but all the instances that were mistakenly used for GregorianDateTime initialization).
Also, the patch needs a change log.
Created attachment 19273 [details]
proposed fix
Committed revision 30625. |
The patch should say enough :-).... --- JavaScriptCore/kjs/date_object.cpp 2008/01/16 12:24:15 1.1 +++ JavaScriptCore/kjs/date_object.cpp 2008/01/16 12:24:21 @@ -908,7 +908,7 @@ // fall back to local timezone if (!haveTZ) { GregorianDateTime t; - memset(&t, 0, sizeof(tm)); + memset(&t, 0, sizeof(t)); t.monthDay = day; t.month = month; t.year = year - 1900;