Title: [131640] trunk
- Revision
- 131640
- Author
- [email protected]
- Date
- 2012-10-17 14:09:45 -0700 (Wed, 17 Oct 2012)
Log Message
Integer overflows/underflows in all Gamepad controller api calls.
https://bugs.webkit.org/show_bug.cgi?id=97262
Patch by Scott Graham <[email protected]> on 2012-10-17
Reviewed by Abhishek Arya.
Tools:
Range check controller inputs. This code is not exposed to the web,
but makes fuzzers try less hard to break uninteresting code.
* DumpRenderTree/chromium/TestRunner/GamepadController.cpp:
(GamepadController::setButtonCount):
(GamepadController::setButtonData):
(GamepadController::setAxisCount):
(GamepadController::setAxisData):
LayoutTests:
* gamepad/gamepad-out-of-range-crasher.html: Added.
* gamepad/gamepad-out-of-range-crasher-expected.txt: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (131639 => 131640)
--- trunk/LayoutTests/ChangeLog 2012-10-17 21:01:18 UTC (rev 131639)
+++ trunk/LayoutTests/ChangeLog 2012-10-17 21:09:45 UTC (rev 131640)
@@ -1,3 +1,13 @@
+2012-10-17 Scott Graham <[email protected]>
+
+ Integer overflows/underflows in all Gamepad controller api calls.
+ https://bugs.webkit.org/show_bug.cgi?id=97262
+
+ Reviewed by Abhishek Arya.
+
+ * gamepad/gamepad-out-of-range-crasher.html: Added.
+ * gamepad/gamepad-out-of-range-crasher-expected.txt: Added.
+
2012-10-17 Tony Chang <[email protected]>
Unreviewed, Chromium baselines for shadow DOM changes to RenderSlider.
Added: trunk/LayoutTests/gamepad/gamepad-out-of-range-crasher-expected.txt (0 => 131640)
--- trunk/LayoutTests/gamepad/gamepad-out-of-range-crasher-expected.txt (rev 0)
+++ trunk/LayoutTests/gamepad/gamepad-out-of-range-crasher-expected.txt 2012-10-17 21:09:45 UTC (rev 131640)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+Range checks; just shouldn't crash.
Added: trunk/LayoutTests/gamepad/gamepad-out-of-range-crasher.html (0 => 131640)
--- trunk/LayoutTests/gamepad/gamepad-out-of-range-crasher.html (rev 0)
+++ trunk/LayoutTests/gamepad/gamepad-out-of-range-crasher.html 2012-10-17 21:09:45 UTC (rev 131640)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<body>
+<script src=""
+<script>
+ if (window.gamepadController)
+ {
+ // check some out of range values.
+ for (var i = -100; i < 100; ++i)
+ {
+ gamepadController.connect(i);
+ gamepadController.setId(i, "name");
+ for (var j = -100; i < 100; ++i)
+ {
+ gamepadController.setButtonCount(i, j);
+ gamepadController.setAxisCount(i, j);
+ gamepadController.setButtonData(i, j, 0.0);
+ gamepadController.setAxisData(i, j, 0.0);
+ }
+ gamepadController.disconnect(i);
+ }
+ }
+ else
+ {
+ console.log("FAIL: no gamepadController available.")
+ }
+</script>
+<script src=""
+<p>Range checks; just shouldn't crash.</p>
+</body>
Modified: trunk/Tools/ChangeLog (131639 => 131640)
--- trunk/Tools/ChangeLog 2012-10-17 21:01:18 UTC (rev 131639)
+++ trunk/Tools/ChangeLog 2012-10-17 21:09:45 UTC (rev 131640)
@@ -1,3 +1,19 @@
+2012-10-17 Scott Graham <[email protected]>
+
+ Integer overflows/underflows in all Gamepad controller api calls.
+ https://bugs.webkit.org/show_bug.cgi?id=97262
+
+ Reviewed by Abhishek Arya.
+
+ Range check controller inputs. This code is not exposed to the web,
+ but makes fuzzers try less hard to break uninteresting code.
+
+ * DumpRenderTree/chromium/TestRunner/GamepadController.cpp:
+ (GamepadController::setButtonCount):
+ (GamepadController::setButtonData):
+ (GamepadController::setAxisCount):
+ (GamepadController::setAxisData):
+
2012-10-17 Joseph Pecoraro <[email protected]>
Unreviewed watchlist email change.
Modified: trunk/Tools/DumpRenderTree/chromium/TestRunner/GamepadController.cpp (131639 => 131640)
--- trunk/Tools/DumpRenderTree/chromium/TestRunner/GamepadController.cpp 2012-10-17 21:01:18 UTC (rev 131639)
+++ trunk/Tools/DumpRenderTree/chromium/TestRunner/GamepadController.cpp 2012-10-17 21:09:45 UTC (rev 131640)
@@ -128,6 +128,8 @@
if (index < 0 || index >= static_cast<int>(WebKit::WebGamepads::itemsLengthCap))
return;
int buttons = args[1].toInt32();
+ if (buttons < 0 || buttons >= static_cast<int>(WebKit::WebGamepad::buttonsLengthCap))
+ return;
m_gamepads.items[index].buttonsLength = buttons;
m_delegate->setGamepadData(m_gamepads);
result->setNull();
@@ -143,6 +145,8 @@
if (index < 0 || index >= static_cast<int>(WebKit::WebGamepads::itemsLengthCap))
return;
int button = args[1].toInt32();
+ if (button < 0 || button >= static_cast<int>(WebKit::WebGamepad::buttonsLengthCap))
+ return;
double data = ""
m_gamepads.items[index].buttons[button] = data;
m_delegate->setGamepadData(m_gamepads);
@@ -159,6 +163,8 @@
if (index < 0 || index >= static_cast<int>(WebKit::WebGamepads::itemsLengthCap))
return;
int axes = args[1].toInt32();
+ if (axes < 0 || axes >= static_cast<int>(WebKit::WebGamepad::axesLengthCap))
+ return;
m_gamepads.items[index].axesLength = axes;
m_delegate->setGamepadData(m_gamepads);
result->setNull();
@@ -174,6 +180,8 @@
if (index < 0 || index >= static_cast<int>(WebKit::WebGamepads::itemsLengthCap))
return;
int axis = args[1].toInt32();
+ if (axis < 0 || axis >= static_cast<int>(WebKit::WebGamepad::axesLengthCap))
+ return;
double data = ""
m_gamepads.items[index].axes[axis] = data;
m_delegate->setGamepadData(m_gamepads);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
