Skip to site navigation (Press enter)

[webkit-changes] [145605] branches/safari-536.30-branch

lforschler Tue, 12 Mar 2013 16:08:22 -0700

Title: [145605] branches/safari-536.30-branch

Revision: 145605
Author: [email protected]
Date: 2013-03-12 16:10:17 -0700 (Tue, 12 Mar 2013)

Log Message

Merged r131315.  <rdar://problem/13334884>


Modified Paths

branches/safari-536.30-branch/LayoutTests/ChangeLog
branches/safari-536.30-branch/Source/WebCore/ChangeLog
branches/safari-536.30-branch/Source/WebCore/platform/SharedBuffer.cpp


Added Paths

branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug-expected.txt
branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug.mht

Diff

Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145604 => 145605)


--- branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-12 23:04:38 UTC (rev 145604)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-12 23:10:17 UTC (rev 145605)
@@ -1,5 +1,21 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r131315
+
+    2012-10-15  Jay Civelli  <[email protected]>
+
+            Calling WebCore::SharedBuffer::append(data, 0) on a shared buffer when
+            its current position is at a segment boundary (4096) ends up adding an
+            unitialized segment (with uninitialized memory) to the SharedBuffer.
+            https://bugs.webkit.org/show_bug.cgi?id=99000
+
+            Reviewed by Adam Barth.
+
+            * mhtml/shared_buffer_bug-expected.txt: Added.
+            * mhtml/shared_buffer_bug.mht: Added.
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r128524
 
     2012-09-13  Tom Sepez  <[email protected]>

Copied: branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug-expected.txt (from rev 131315, trunk/LayoutTests/mhtml/shared_buffer_bug-expected.txt) (0 => 145605)


--- branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug-expected.txt	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug-expected.txt	2013-03-12 23:10:17 UTC (rev 145605)
@@ -0,0 +1,2 @@
+This is a test for a bug in SharedBuffer.
+

Copied: branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug.mht (from rev 131315, trunk/LayoutTests/mhtml/shared_buffer_bug.mht) (0 => 145605)


--- branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug.mht	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/mhtml/shared_buffer_bug.mht	2013-03-12 23:10:17 UTC (rev 145605)
@@ -0,0 +1,176 @@
+From: <Saved by WebKit>
+Subject:
+Date: Sat, 12 Oct 2012 10:15:17 -0700
+MIME-Version: 1.0
+Content-Type: multipart/related;
+	type="text/html";
+	boundary="----=_NextPart_000_7387_D22A981E.ADD1887E"
+
+------=_NextPart_000_7387_D22A981E.ADD1887E
+Content-Type: text/html
+Content-Transfer-Encoding: quoted-printable
+Content-Location: http://localhost/sharred_buffer_bug.html
+
+<html><head><meta charset=3D"ISO-8859-1">
+<link rel=3D"stylesheet" type=3D"text/css" href=""
+es/style.css">
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+}
+</script>
+
+</head>
+
+<body>
+  This is a test for a bug in SharedBuffer.
+  <h1>This text should not be shown</h1>
+
+
+
+</body></html>
+------=_NextPart_000_7387_D22A981E.ADD1887E
+Content-Type: text/css
+Content-Transfer-Encoding: quoted-printable
+Content-Location: http://localhost/resources/style.css
+
+/*
+The point is to reach a size of n * 4096 bytes (with n > 1)
+followed by a blank line to trigger a bug in SharredBuffer.
+
+Let's go:
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+012345678901234567890123456789012345678901234567890123456789
+*/
+
+
+h1 { visibility: hidden; }
+
+------=_NextPart_000_7387_D22A981E.ADD1887E--

Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145604 => 145605)


--- branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-12 23:04:38 UTC (rev 145604)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-12 23:10:17 UTC (rev 145605)
@@ -1,5 +1,21 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r131315
+
+    2012-10-15  Jay Civelli  <[email protected]>
+
+            Calling WebCore::SharedBuffer::append(data, 0) on a shared buffer when
+            its current position is at a segment boundary (4096) ends up adding an
+            unitialized segment (with uninitialized memory) to the SharedBuffer.
+            https://bugs.webkit.org/show_bug.cgi?id=99000
+
+            Reviewed by Adam Barth.
+
+            * platform/SharedBuffer.cpp:
+            (WebCore::SharedBuffer::append):
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r131110
 
     2012-10-11  Adam Barth  <[email protected]>

Modified: branches/safari-536.30-branch/Source/WebCore/platform/SharedBuffer.cpp (145604 => 145605)


--- branches/safari-536.30-branch/Source/WebCore/platform/SharedBuffer.cpp	2013-03-12 23:04:38 UTC (rev 145604)
+++ branches/safari-536.30-branch/Source/WebCore/platform/SharedBuffer.cpp	2013-03-12 23:10:17 UTC (rev 145605)
@@ -144,6 +144,8 @@
 void SharedBuffer::append(const char* data, unsigned length)
 {
     ASSERT(!m_purgeableBuffer);
+    if (!length)
+        return;
 
     maybeTransferPlatformData();

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes