Bug 150931 – TestWebKitAPI crashed in TestWebKitAPI: TestWebKitAPI::SharedBufferTest_copyBufferCreatedWithContentsOfExistingFile_Test::TestBody

• Status: RESOLVED
• Resolution: FIXED
• Component: Tools / Tests

[David Kilzer (:ddkilzer)]

TestWebKitAPI crashed in TestWebKitAPI: TestWebKitAPI::SharedBufferTest_copyBufferCreatedWithContentsOfExistingFile_Test::TestBody with ASan enabled.

The bug is that strnstr() assumes the second argument is null-terminated, and the implementation of strnstr() on OS X calls strlen() on the second argument.  This causes an out-of-bounds read if the memory after the second argument doesn't happen to contain a NULL character.

[David Kilzer (:ddkilzer)]

<rdar://problem/23409384>

[David Kilzer (:ddkilzer)]

Created attachment 264864 [details]
Patch v1

[youenn fablet]

Comment on attachment 264864 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=264864&action=review

> Tools/TestWebKitAPI/Tests/WebCore/SharedBuffer.cpp:95
> +    EXPECT_GT(buffer->size(), 0);

Maybe EXPECT_TRUE(!!buffer->size()); will make mac bots happy?

[Darin Adler]

Comment on attachment 264864 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=264864&action=review

>> Tools/TestWebKitAPI/Tests/WebCore/SharedBuffer.cpp:95
>> +    EXPECT_GT(buffer->size(), 0);
> 
> Maybe EXPECT_TRUE(!!buffer->size()); will make mac bots happy?

It’s also possible that 0U instead of 0 will work.

[David Kilzer (:ddkilzer)]

Created attachment 264881 [details]
Patch to fix build failures

[David Kilzer (:ddkilzer)]

Committed r192085: <http://trac.webkit.org/changeset/192085>