Title: [179676] branches/safari-600.1.4.15-branch/Source/_javascript_Core
- Revision
- 179676
- Author
- [email protected]
- Date
- 2015-02-04 22:42:42 -0800 (Wed, 04 Feb 2015)
Log Message
Merged r178311. rdar://problem/19718965
Modified Paths
Diff
Modified: branches/safari-600.1.4.15-branch/Source/_javascript_Core/ChangeLog (179675 => 179676)
--- branches/safari-600.1.4.15-branch/Source/_javascript_Core/ChangeLog 2015-02-05 06:18:25 UTC (rev 179675)
+++ branches/safari-600.1.4.15-branch/Source/_javascript_Core/ChangeLog 2015-02-05 06:42:42 UTC (rev 179676)
@@ -1,3 +1,28 @@
+2015-02-04 Lucas Forschler <[email protected]>
+
+ Merge r178311
+
+ 2015-01-12 Geoffrey Garen <[email protected]>
+
+ Out of bounds read in IdentifierArena::makeIdentifier
+ https://bugs.webkit.org/show_bug.cgi?id=140376
+
+ Patch by Alexey Proskuryakov.
+
+ Reviewed and ChangeLogged by Geoffrey Garen.
+
+ No test, since this is a small past-the-end read, which is very
+ difficult to turn into a reproducible failing test -- and existing tests
+ crash reliably using ASan.
+
+ * parser/ParserArena.h:
+ (JSC::IdentifierArena::makeIdentifier):
+ (JSC::IdentifierArena::makeIdentifierLCharFromUChar): Check for a
+ zero-length string input, like we do in the literal parser, since it is
+ not valid to dereference characters in a zero-length string.
+
+ A zero-length string is allowed in _javascript_ -- for example, "".
+
2015-01-28 Lucas Forschler <[email protected]>
Merge r178364
Modified: branches/safari-600.1.4.15-branch/Source/_javascript_Core/parser/ParserArena.h (179675 => 179676)
--- branches/safari-600.1.4.15-branch/Source/_javascript_Core/parser/ParserArena.h 2015-02-05 06:18:25 UTC (rev 179675)
+++ branches/safari-600.1.4.15-branch/Source/_javascript_Core/parser/ParserArena.h 2015-02-05 06:42:42 UTC (rev 179676)
@@ -26,6 +26,7 @@
#ifndef ParserArena_h
#define ParserArena_h
+#include "CommonIdentifiers.h"
#include "Identifier.h"
#include <array>
#include <wtf/SegmentedVector.h>
@@ -72,6 +73,8 @@
template <typename T>
ALWAYS_INLINE const Identifier& IdentifierArena::makeIdentifier(VM* vm, const T* characters, size_t length)
{
+ if (!length)
+ return vm->propertyNames->emptyIdentifier;
if (characters[0] >= MaximumCachableCharacter) {
m_identifiers.append(Identifier(vm, characters, length));
return m_identifiers.last();
@@ -93,6 +96,8 @@
ALWAYS_INLINE const Identifier& IdentifierArena::makeIdentifierLCharFromUChar(VM* vm, const UChar* characters, size_t length)
{
+ if (!length)
+ return vm->propertyNames->emptyIdentifier;
if (characters[0] >= MaximumCachableCharacter) {
m_identifiers.append(Identifier::createLCharFromUChar(vm, characters, length));
return m_identifiers.last();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
