| Summary: | equalIgnoringNullity() only comparing half the bytes for equality | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Thomas Sepez <tsepez> | ||||
| Component: | WebCore Misc. | Assignee: | Thomas Sepez <tsepez> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | abarth, webkit.review.bot | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
Created attachment 128029 [details]
Patch plus change to make test flunk without the patch.
Did you look at other uses of memcmp in that file to make sure they were ok ? Just checked that its the only use in the .h, and in the .cpp, the two uses multiply by the size of the templated chartype. Comment on attachment 128029 [details] Patch plus change to make test flunk without the patch. Clearing flags on attachment: 128029 Committed r108412: <http://trac.webkit.org/changeset/108412> All reviewed patches have been landed. Closing bug. |
In WebKit/Source/JavaScriptCore/wtf/text/StringImpl.h:731 template<size_t inlineCapacity> bool equalIgnoringNullity(const Vector<UChar, inlineCapacity>& a, StringImpl* b) { if (!b) return !a.size(); if (a.size() != b->length()) return false; return !memcmp(a.data(), b->characters(), b->length()); } Which will memcmp() exactly half the bytes since sizeof UChar is 2. This only gets called from XSSAuditor, and owing to absence of unit tests, the way to test this is via an XSSAuditor test.