Title: [132676] branches/chromium/1271
- Revision
- 132676
- Author
- [email protected]
- Date
- 2012-10-26 10:52:33 -0700 (Fri, 26 Oct 2012)
Log Message
Merge 131315 - Calling WebCore::SharedBuffer::append(data, 0) on a shared buffer when
its current position is at a segment boundary (4096) ends up adding an
unitialized segment (with uninitialized memory) to the SharedBuffer.
https://bugs.webkit.org/show_bug.cgi?id=99000
Reviewed by Adam Barth.
Source/WebCore:
* platform/SharedBuffer.cpp:
(WebCore::SharedBuffer::append):
LayoutTests:
* mhtml/shared_buffer_bug-expected.txt: Added.
* mhtml/shared_buffer_bug.mht: Added.
[email protected]
Review URL: https://codereview.chromium.org/11316005
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1271/LayoutTests/mhtml/shared_buffer_bug-expected.txt (from rev 131315, trunk/LayoutTests/mhtml/shared_buffer_bug-expected.txt) (0 => 132676)
--- branches/chromium/1271/LayoutTests/mhtml/shared_buffer_bug-expected.txt (rev 0)
+++ branches/chromium/1271/LayoutTests/mhtml/shared_buffer_bug-expected.txt 2012-10-26 17:52:33 UTC (rev 132676)
@@ -0,0 +1,2 @@
+This is a test for a bug in SharedBuffer.
+
Copied: branches/chromium/1271/LayoutTests/mhtml/shared_buffer_bug.mht (from rev 131315, trunk/LayoutTests/mhtml/shared_buffer_bug.mht) (0 => 132676)
--- branches/chromium/1271/LayoutTests/mhtml/shared_buffer_bug.mht (rev 0)
+++ branches/chromium/1271/LayoutTests/mhtml/shared_buffer_bug.mht 2012-10-26 17:52:33 UTC (rev 132676)
@@ -0,0 +1,176 @@
+From: <Saved by WebKit>
+Subject:
+Date: Sat, 12 Oct 2012 10:15:17 -0700
+MIME-Version: 1.0
+Content-Type: multipart/related;
+ type="text/html";
+ boundary="----=_NextPart_000_7387_D22A981E.ADD1887E"
+
+------=_NextPart_000_7387_D22A981E.ADD1887E
+Content-Type: text/html
+Content-Transfer-Encoding: quoted-printable
+Content-Location: http://localhost/sharred_buffer_bug.html
+
+<html><head><meta charset=3D"ISO-8859-1">
+<link rel=3D"stylesheet" type=3D"text/css" href=""
+es/style.css">
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+}
+</script>
+
+</head>
+
+<body>
+ This is a test for a bug in SharedBuffer.
+ <h1>This text should not be shown</h1>
+
+
+
+</body></html>
+------=_NextPart_000_7387_D22A981E.ADD1887E
+Content-Type: text/css
+Content-Transfer-Encoding: quoted-printable
+Content-Location: http://localhost/resources/style.css
+
+/*
+The point is to reach a size of n * 4096 bytes (with n > 1)
+followed by a blank line to trigger a bug in SharredBuffer.
+
+Let's go:
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+*/
+
+
+h1 { visibility: hidden; }
+
+------=_NextPart_000_7387_D22A981E.ADD1887E--
Modified: branches/chromium/1271/Source/WebCore/platform/SharedBuffer.cpp (132675 => 132676)
--- branches/chromium/1271/Source/WebCore/platform/SharedBuffer.cpp 2012-10-26 17:49:23 UTC (rev 132675)
+++ branches/chromium/1271/Source/WebCore/platform/SharedBuffer.cpp 2012-10-26 17:52:33 UTC (rev 132676)
@@ -147,6 +147,8 @@
void SharedBuffer::append(const char* data, unsigned length)
{
ASSERT(!m_purgeableBuffer);
+ if (!length)
+ return;
maybeTransferPlatformData();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
