Bug 187444 – PropertyTable::skipDeletedEntries() should guard against iterating past the table end.

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

PropertyTable supports C++ iteration by offering begin() and end() methods, and an iterator class.  The begin() methods and the iterator operator++() method uses PropertyTable::skipDeletedEntries() to skip over deleted entries in the table.  However, PropertyTable::skipDeletedEntries() does not prevent the iteration pointer from being incremented past the end of the table.  As a result, we can iterate past the end of the table.  Note that the C++ iteration protocol tests for the iterator not being equal to the end() value.  It does not do a <= test.  If the iterator ever shoots past end, the loop will effectively not terminate.

This issue can manifest if and only if the last entry in the table is a deleted one.

<rdar://problem/41282849>

[Mark Lam]

Created attachment 344540 [details]
proposed patch.

[Mark Lam]

Created attachment 344541 [details]
proposed patch.

[Saam Barati]

Comment on attachment 344541 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=344541&action=review

> Source/JavaScriptCore/ChangeLog:18
> +        This issue can manifest if and only if the last entry in the table is a deleted

Crazy

[Mark Lam]

Comment on attachment 344541 [details]
proposed patch.

Thanks for the review.  Landing.

[WebKit Commit Bot]

Comment on attachment 344541 [details]
proposed patch.

Clearing flags on attachment: 344541

Committed r233625: <https://trac.webkit.org/changeset/233625>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.