Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4b568b921b7a39476813832bace8b169d47d751b
https://github.com/WebKit/WebKit/commit/4b568b921b7a39476813832bace8b169d47d751b
Author: Angelos Oikonomopoulos <[email protected]>
Date: 2025-03-19 (Wed, 19 Mar 2025)
Changed paths:
M Source/JavaScriptCore/wasm/WasmOperations.cpp
M Source/JavaScriptCore/wasm/WasmOperationsInlines.h
M Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h
Log Message:
-----------
Catch integer overflow on 32-bits in JSWebAssemblyArray.h
https://bugs.webkit.org/show_bug.cgi?id=289523
Reviewed by Yusuke Suzuki.
Array size times element size may wrap around when size_t is only 4
bytes. Catch and propagate.
* Source/JavaScriptCore/wasm/WasmOperations.cpp:
(JSC::Wasm::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/wasm/WasmOperationsInlines.h:
(JSC::Wasm::tryFillArray):
(JSC::Wasm::arrayNew):
(JSC::Wasm::tryCopyElementsInReverse):
(JSC::Wasm::arrayNewFixed):
(JSC::Wasm::createArrayFromDataSegment):
(JSC::Wasm::arrayNewElem):
(JSC::Wasm::fillArray): Deleted.
(JSC::Wasm::copyElementsInReverse): Deleted.
* Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h:
Canonical link: https://commits.webkit.org/292355@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
