Title: [275048] trunk/Source/WebCore
- Revision
- 275048
- Author
- [email protected]
- Date
- 2021-03-25 11:20:58 -0700 (Thu, 25 Mar 2021)
Log Message
Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107:33: runtime error: signed integer overflow: 268435455 * 16 cannot be represented in type 'int'
https://bugs.webkit.org/show_bug.cgi?id=223718
Reviewed by Darin Adler.
Use Checked<> for the result in consumeCharacterReference() to deal with overflows
in a well-defined manner.
* xml/parser/CharacterReferenceParserInlines.h:
(WebCore::consumeCharacterReference):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (275047 => 275048)
--- trunk/Source/WebCore/ChangeLog 2021-03-25 17:36:00 UTC (rev 275047)
+++ trunk/Source/WebCore/ChangeLog 2021-03-25 18:20:58 UTC (rev 275048)
@@ -1,3 +1,16 @@
+2021-03-25 Chris Dumez <[email protected]>
+
+ Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107:33: runtime error: signed integer overflow: 268435455 * 16 cannot be represented in type 'int'
+ https://bugs.webkit.org/show_bug.cgi?id=223718
+
+ Reviewed by Darin Adler.
+
+ Use Checked<> for the result in consumeCharacterReference() to deal with overflows
+ in a well-defined manner.
+
+ * xml/parser/CharacterReferenceParserInlines.h:
+ (WebCore::consumeCharacterReference):
+
2021-03-25 John Wilander <[email protected]>
PCM: Rename attributeOn to attributionDestination and change the IDL data type of attributionSourceId to unsigned long
Modified: trunk/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h (275047 => 275048)
--- trunk/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h 2021-03-25 17:36:00 UTC (rev 275047)
+++ trunk/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h 2021-03-25 18:20:58 UTC (rev 275048)
@@ -51,8 +51,7 @@
Decimal,
Named
} state = Initial;
- UChar32 result = 0;
- bool overflow = false;
+ Checked<UChar32, RecordOverflow> result = 0;
StringBuilder consumedCharacters;
while (!source.isEmpty()) {
@@ -104,18 +103,17 @@
case Hex:
Hex:
if (isASCIIHexDigit(character)) {
- result = result * 16 + toASCIIHexValue(character);
- if (result > UCHAR_MAX_VALUE)
- overflow = true;
+ result *= 16;
+ result += static_cast<UChar32>(toASCIIHexValue(character));
break;
}
if (character == ';') {
source.advancePastNonNewline();
- decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+ decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
return true;
}
if (ParserFunctions::acceptMalformed()) {
- decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+ decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
return true;
}
unconsumeCharacters(source, consumedCharacters);
@@ -123,18 +121,17 @@
case Decimal:
Decimal:
if (isASCIIDigit(character)) {
- result = result * 10 + character - '0';
- if (result > UCHAR_MAX_VALUE)
- overflow = true;
+ result *= 10;
+ result += (character - '0');
break;
}
if (character == ';') {
source.advancePastNonNewline();
- decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+ decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
return true;
}
if (ParserFunctions::acceptMalformed()) {
- decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(overflow ? 0 : result));
+ decodedCharacter.appendCharacter(ParserFunctions::legalEntityFor(result.hasOverflowed() ? 0 : result.unsafeGet()));
return true;
}
unconsumeCharacters(source, consumedCharacters);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
