Bug 79135 – equalIgnoringNullity() only comparing half the bytes for equality

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Thomas Sepez]

In WebKit/Source/JavaScriptCore/wtf/text/StringImpl.h:731

template<size_t inlineCapacity>
bool equalIgnoringNullity(const Vector<UChar, inlineCapacity>& a, StringImpl* b)
{
    if (!b)
        return !a.size();
    if (a.size() != b->length())
        return false;
    return !memcmp(a.data(), b->characters(), b->length());
}

Which will memcmp() exactly half the bytes since sizeof UChar is 2.

This only gets called from XSSAuditor, and owing to absence of unit tests, the way to test this is via an XSSAuditor test.

[Thomas Sepez]

Created attachment 128029 [details]
Patch plus change to make test flunk without the patch.

[Adam Barth]

Did you look at other uses of memcmp in that file to make sure they were ok ?

[Thomas Sepez]

Just checked that its the only use in the .h, and in the .cpp, the two uses multiply by the size of the templated chartype.

[WebKit Review Bot]

Comment on attachment 128029 [details]
Patch plus change to make test flunk without the patch.

Clearing flags on attachment: 128029

Committed r108412: <http://trac.webkit.org/changeset/108412>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.