Title: [262547] trunk/Source/WebCore
- Revision
- 262547
- Author
- [email protected]
- Date
- 2020-06-04 11:06:57 -0700 (Thu, 04 Jun 2020)
Log Message
[iOS] Validate index parameter in PlatformPasteboard
https://bugs.webkit.org/show_bug.cgi?id=212713
<rdar://problem/60068765>
Reviewed by Alex Christensen.
Follow-up to r262529 to also make sure that the index is not negative after
casting to NSInteger.
* platform/ios/PlatformPasteboardIOS.mm:
(WebCore::PlatformPasteboard::readBuffer const):
(WebCore::PlatformPasteboard::readString const):
(WebCore::PlatformPasteboard::readURL const):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (262546 => 262547)
--- trunk/Source/WebCore/ChangeLog 2020-06-04 18:04:38 UTC (rev 262546)
+++ trunk/Source/WebCore/ChangeLog 2020-06-04 18:06:57 UTC (rev 262547)
@@ -1,3 +1,19 @@
+2020-06-04 Chris Dumez <[email protected]>
+
+ [iOS] Validate index parameter in PlatformPasteboard
+ https://bugs.webkit.org/show_bug.cgi?id=212713
+ <rdar://problem/60068765>
+
+ Reviewed by Alex Christensen.
+
+ Follow-up to r262529 to also make sure that the index is not negative after
+ casting to NSInteger.
+
+ * platform/ios/PlatformPasteboardIOS.mm:
+ (WebCore::PlatformPasteboard::readBuffer const):
+ (WebCore::PlatformPasteboard::readString const):
+ (WebCore::PlatformPasteboard::readURL const):
+
2020-06-04 Xabier Rodriguez Calvar <[email protected]>
[EME][GStreamer] cdmProxyAttached does not need to force a bump ref in the signature
Modified: trunk/Source/WebCore/platform/ios/PlatformPasteboardIOS.mm (262546 => 262547)
--- trunk/Source/WebCore/platform/ios/PlatformPasteboardIOS.mm 2020-06-04 18:04:38 UTC (rev 262546)
+++ trunk/Source/WebCore/platform/ios/PlatformPasteboardIOS.mm 2020-06-04 18:06:57 UTC (rev 262547)
@@ -695,7 +695,7 @@
RefPtr<SharedBuffer> PlatformPasteboard::readBuffer(size_t index, const String& type) const
{
- if ((NSInteger)index >= [m_pasteboard numberOfItems])
+ if ((NSInteger)index < 0 || (NSInteger)index >= [m_pasteboard numberOfItems])
return nullptr;
NSIndexSet *indexSet = [NSIndexSet indexSetWithIndex:index];
@@ -714,7 +714,7 @@
return [(NSURL *)readURL(index, title) absoluteString];
}
- if ((NSInteger)index >= [m_pasteboard numberOfItems])
+ if ((NSInteger)index < 0 || (NSInteger)index >= [m_pasteboard numberOfItems])
return { };
NSIndexSet *indexSet = [NSIndexSet indexSetWithIndex:index];
@@ -742,7 +742,7 @@
URL PlatformPasteboard::readURL(size_t index, String& title) const
{
- if ((NSInteger)index >= [m_pasteboard numberOfItems])
+ if ((NSInteger)index < 0 || (NSInteger)index >= [m_pasteboard numberOfItems])
return { };
id value = [m_pasteboard valuesForPasteboardType:(__bridge NSString *)kUTTypeURL inItemSet:[NSIndexSet indexSetWithIndex:index]].firstObject;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
