Reviewers: jochen,
Description:
Fix free-after-free bug in ExternalStreamingStream::ResetToBookmark.
[email protected]
BUG=chromium:470930
LOG=N
Please review this at https://codereview.chromium.org/1156103015/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+6, -2 lines):
M src/scanner-character-streams.cc
Index: src/scanner-character-streams.cc
diff --git a/src/scanner-character-streams.cc
b/src/scanner-character-streams.cc
index
40d2abcf13f79e08c33e75e58445184248c6a696..bc5cde490685d8ba1a2719acab56a33bb0f60fab
100644
--- a/src/scanner-character-streams.cc
+++ b/src/scanner-character-streams.cc
@@ -434,10 +434,14 @@ void ExternalStreamingStream::ResetToBookmark() {
pos_ = bookmark_;
- // current_data_ can point to bookmark_data_'s buffer.
- current_data_ = bookmark_data_.start();
+ // bookmark_data_* => current_data_*
+ // (current_data_ assumes ownership of its memory.)
+ uint8_t* data = new uint8_t[bookmark_data_.length()];
current_data_offset_ = 0;
current_data_length_ = bookmark_data_.length();
+ CopyCharsUnsigned(data, bookmark_data_.begin(), bookmark_data_.length());
+ delete[] current_data_;
+ current_data_ = data;
// bookmark_buffer_ needs to be copied to buffer_.
CopyCharsUnsigned(buffer_, bookmark_buffer_.begin(),
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
