Title: [153548] trunk/Source/WebCore
- Revision
- 153548
- Author
- [email protected]
- Date
- 2013-07-31 17:03:10 -0700 (Wed, 31 Jul 2013)
Log Message
Replace CRASH() on overflow with Checked<>
https://bugs.webkit.org/show_bug.cgi?id=119327
Reviewed by Oliver Hunt.
Use a checked type that allows us to automate bound checks. We use a
non-recording Checked<> to keep the behavior.
No behavior change, no new tests needed.
* dom/Text.cpp:
(WebCore::Text::wholeText):
* platform/audio/AudioArray.h:
(WebCore::AudioArray::allocate):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (153547 => 153548)
--- trunk/Source/WebCore/ChangeLog 2013-07-31 23:57:23 UTC (rev 153547)
+++ trunk/Source/WebCore/ChangeLog 2013-08-01 00:03:10 UTC (rev 153548)
@@ -1,5 +1,22 @@
2013-07-31 Kwang Yul Seo <[email protected]>
+ Replace CRASH() on overflow with Checked<>
+ https://bugs.webkit.org/show_bug.cgi?id=119327
+
+ Reviewed by Oliver Hunt.
+
+ Use a checked type that allows us to automate bound checks. We use a
+ non-recording Checked<> to keep the behavior.
+
+ No behavior change, no new tests needed.
+
+ * dom/Text.cpp:
+ (WebCore::Text::wholeText):
+ * platform/audio/AudioArray.h:
+ (WebCore::AudioArray::allocate):
+
+2013-07-31 Kwang Yul Seo <[email protected]>
+
Use emptyString instead of String("")
https://bugs.webkit.org/show_bug.cgi?id=119335
Modified: trunk/Source/WebCore/dom/Text.cpp (153547 => 153548)
--- trunk/Source/WebCore/dom/Text.cpp 2013-07-31 23:57:23 UTC (rev 153547)
+++ trunk/Source/WebCore/dom/Text.cpp 2013-08-01 00:03:10 UTC (rev 153548)
@@ -37,6 +37,7 @@
#include "StyleInheritedData.h"
#include "StyleResolver.h"
+#include <wtf/CheckedArithmetic.h>
#include <wtf/text/CString.h>
#include <wtf/text/StringBuilder.h>
@@ -126,25 +127,23 @@
const Text* endText = latestLogicallyAdjacentTextNode(this);
Node* _onePastEndText_ = endText->nextSibling();
- unsigned resultLength = 0;
+ Checked<unsigned> resultLength = 0;
for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
if (!n->isTextNode())
continue;
const Text* t = static_cast<const Text*>(n);
const String& data = ""
- if (std::numeric_limits<unsigned>::max() - data.length() < resultLength)
- CRASH();
resultLength += data.length();
}
StringBuilder result;
- result.reserveCapacity(resultLength);
+ result.reserveCapacity(resultLength.unsafeGet());
for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
if (!n->isTextNode())
continue;
const Text* t = static_cast<const Text*>(n);
result.append(t->data());
}
- ASSERT(result.length() == resultLength);
+ ASSERT(result.length() == resultLength.unsafeGet());
return result.toString();
}
Modified: trunk/Source/WebCore/platform/audio/AudioArray.h (153547 => 153548)
--- trunk/Source/WebCore/platform/audio/AudioArray.h 2013-07-31 23:57:23 UTC (rev 153547)
+++ trunk/Source/WebCore/platform/audio/AudioArray.h 2013-08-01 00:03:10 UTC (rev 153548)
@@ -30,6 +30,7 @@
#define AudioArray_h
#include <string.h>
+#include <wtf/CheckedArithmetic.h>
#include <wtf/FastMalloc.h>
#include <wtf/Vector.h>
@@ -51,14 +52,9 @@
// It's OK to call allocate() multiple times, but data will *not* be copied from an initial allocation
// if re-allocated. Allocations are zero-initialized.
- void allocate(size_t n)
+ void allocate(Checked<size_t> n)
{
- // Although n is a size_t, its true limit is max unsigned because we use unsigned in zeroRange()
- // and copyToRange(). Also check for integer overflow.
- if (n > std::numeric_limits<unsigned>::max() / sizeof(T))
- CRASH();
-
- unsigned initialSize = sizeof(T) * n;
+ Checked<unsigned> initialSize = sizeof(T) * n;
#if USE(WEBAUDIO_FFMPEG) || USE(WEBAUDIO_OPENMAX_DL_FFT)
const size_t alignment = 32;
@@ -76,11 +72,7 @@
// then we'll have to reallocate and from then on allocate extra.
static size_t extraAllocationBytes = 0;
- // Again, check for integer overflow.
- if (initialSize + extraAllocationBytes < initialSize)
- CRASH();
-
- T* allocation = static_cast<T*>(fastMalloc(initialSize + extraAllocationBytes));
+ T* allocation = static_cast<T*>(fastMalloc((initialSize + extraAllocationBytes).unsafeGet()));
if (!allocation)
CRASH();
T* alignedData = alignedAddress(allocation, alignment);
@@ -88,7 +80,7 @@
if (alignedData == allocation || extraAllocationBytes == alignment) {
m_allocation = allocation;
m_alignedData = alignedData;
- m_size = n;
+ m_size = n.unsafeGet();
isAllocationGood = true;
zero();
} else {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
