Revision: 20860
Author: [email protected]
Date: Thu Apr 17 22:06:11 2014 UTC
Log: Version 3.24.35.33 (merged r20525)
Make TypedArray::New fucntions crash on wrong lengths.
BUG=359802
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/241843002
http://code.google.com/p/v8/source/detail?r=20860
Modified:
/branches/3.24/src/api.cc
/branches/3.24/src/version.cc
=======================================
--- /branches/3.24/src/api.cc Tue Mar 25 07:48:31 2014 UTC
+++ /branches/3.24/src/api.cc Thu Apr 17 22:06:11 2014 UTC
@@ -5902,6 +5902,7 @@
ASSERT(byte_offset % sizeof(ElementType) == 0);
CHECK(length <= (std::numeric_limits<size_t>::max() /
sizeof(ElementType)));
+ CHECK(length <= static_cast<size_t>(i::Smi::kMaxValue));
size_t byte_length = length * sizeof(ElementType);
SetupArrayBufferView(
isolate, obj, buffer, byte_offset, byte_length);
@@ -5928,6 +5929,11 @@
LOG_API(isolate, \
"v8::" #Type "Array::New(Handle<ArrayBuffer>, size_t,
size_t)"); \
ENTER_V8(isolate); \
+ if (!Utils::ApiCheck(length <=
static_cast<size_t>(i::Smi::kMaxValue), \
+ "v8::" #Type "Array::New(Handle<ArrayBuffer>, size_t,
size_t)", \
+ "length exceeds max allowed value"))
{ \
+ return
Local<Type##Array>(); \
+
} \
i::Handle<i::JSTypedArray> obj
= \
NewTypedArray<ctype,
v8::kExternal##Type##Array, \
i::EXTERNAL_##TYPE##_ELEMENTS>( \
=======================================
--- /branches/3.24/src/version.cc Wed Apr 9 13:33:30 2014 UTC
+++ /branches/3.24/src/version.cc Thu Apr 17 22:06:11 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 24
#define BUILD_NUMBER 35
-#define PATCH_LEVEL 32
+#define PATCH_LEVEL 33
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
