Bug 124644 - machMessageSize uses sizeof(mach_msg_ool_ports_descriptor_t) for out-of-line *memory*
Summary: machMessageSize uses sizeof(mach_msg_ool_ports_descriptor_t) for out-of-line ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Tim Horton
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-20 01:03 PST by Tim Horton
Modified: 2013-11-20 13:26 PST (History)
3 users (show)

See Also:

Attachments
patch (1.55 KB, patch)
2013-11-20 01:06 PST, Tim Horton 		andersca: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Horton 2013-11-20 01:03:54 PST 
machMessageSize does:

        if (numberOfOOLMemoryDescriptors)
            size += (numberOfOOLMemoryDescriptors * sizeof(mach_msg_ool_ports_descriptor_t));

but then uses descriptor->out_of_line, which is a mach_msg_ool_descriptor_t.
Comment 1 Tim Horton 2013-11-20 01:06:46 PST 
Created attachment 217403 [details]
patch
Comment 2 Tim Horton 2013-11-20 13:26:53 PST 
http://trac.webkit.org/changeset/159581