| Summary: | Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107:33: runtime error: signed integer overflow: 268435455 * 16 cannot be represented in type 'int' | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Chris Dumez <cdumez> | ||||
| Component: | WebCore Misc. | Assignee: | Chris Dumez <cdumez> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | darin, ggaren, sam, webkit-bug-importer | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=176131 | ||||||
| Attachments: |
|
||||||
|
Description
Chris Dumez
2021-03-24 16:48:27 PDT
Created attachment 424201 [details]
Patch
Comment on attachment 424201 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424201&action=review > Source/WebCore/ChangeLog:9 > + Use Checked<> for the result in consumeCharacterReference() to deal with overflows > + in a well-defined manner. The reason UBSan doesn’t like this is that we don’t stop doing the worthless calculations once we have overflowed. Otherwise the code was fine. > Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107 > + result += static_cast<UChar32>(toASCIIHexValue(character)); Surprised that we need a typecast here; would have tried to avoid it. Committed r275048: <https://commits.webkit.org/r275048> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424201 [details]. |