Title: [245847] trunk/Source/WebKit
- Revision
- 245847
- Author
- [email protected]
- Date
- 2019-05-28 21:40:00 -0700 (Tue, 28 May 2019)
Log Message
[WinCairo] REGRESSION(r245186) Crash in NetworkCache::IOChannel::read in http/tests/IndexedDB some tests
https://bugs.webkit.org/show_bug.cgi?id=197941
Reviewed by Don Olmstead.
http/tests/IndexedDB some tests were crashing in
NetworkCache::IOChannel::read in order to allocate a buffer with
std::numeric_limits<size_t>::max() as the size.
IOChannel::read should check the file size, and calculate the read
size.
* NetworkProcess/cache/NetworkCacheIOChannelCurl.cpp:
(WebKit::NetworkCache::IOChannel::read): Limit the read buffer
size by calling FileSystem::getFileSize.
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (245846 => 245847)
--- trunk/Source/WebKit/ChangeLog 2019-05-29 04:38:04 UTC (rev 245846)
+++ trunk/Source/WebKit/ChangeLog 2019-05-29 04:40:00 UTC (rev 245847)
@@ -1,3 +1,21 @@
+2019-05-28 Fujii Hironori <[email protected]>
+
+ [WinCairo] REGRESSION(r245186) Crash in NetworkCache::IOChannel::read in http/tests/IndexedDB some tests
+ https://bugs.webkit.org/show_bug.cgi?id=197941
+
+ Reviewed by Don Olmstead.
+
+ http/tests/IndexedDB some tests were crashing in
+ NetworkCache::IOChannel::read in order to allocate a buffer with
+ std::numeric_limits<size_t>::max() as the size.
+
+ IOChannel::read should check the file size, and calculate the read
+ size.
+
+ * NetworkProcess/cache/NetworkCacheIOChannelCurl.cpp:
+ (WebKit::NetworkCache::IOChannel::read): Limit the read buffer
+ size by calling FileSystem::getFileSize.
+
2019-05-28 Brent Fulgham <[email protected]>
Fix sandbox violation when using QuickLook on iOS
Modified: trunk/Source/WebKit/NetworkProcess/cache/NetworkCacheIOChannelCurl.cpp (245846 => 245847)
--- trunk/Source/WebKit/NetworkProcess/cache/NetworkCacheIOChannelCurl.cpp 2019-05-29 04:38:04 UTC (rev 245846)
+++ trunk/Source/WebKit/NetworkProcess/cache/NetworkCacheIOChannelCurl.cpp 2019-05-29 04:40:00 UTC (rev 245847)
@@ -74,9 +74,17 @@
void IOChannel::read(size_t offset, size_t size, WorkQueue* queue, Function<void(Data&, int error)>&& completionHandler)
{
runTaskInQueue([this, protectedThis = makeRef(*this), offset, size, completionHandler = WTFMove(completionHandler)] {
- Vector<uint8_t> buffer(size);
+ long long fileSize;
+ if (!FileSystem::getFileSize(m_fileDescriptor, fileSize) || fileSize > std::numeric_limits<size_t>::max()) {
+ Data data;
+ completionHandler(data, -1);
+ return;
+ }
+ size_t readSize = fileSize;
+ readSize = std::min(size, readSize);
+ Vector<uint8_t> buffer(readSize);
FileSystem::seekFile(m_fileDescriptor, offset, FileSystem::FileSeekOrigin::Beginning);
- int err = FileSystem::readFromFile(m_fileDescriptor, reinterpret_cast<char*>(buffer.data()), size);
+ int err = FileSystem::readFromFile(m_fileDescriptor, reinterpret_cast<char*>(buffer.data()), readSize);
err = err < 0 ? err : 0;
auto data = ""
completionHandler(data, err);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
