Attachment 347485 Details for Bug 188740 – Patch

[patch] Patch

bug-188740-20180820165510.patch (text/plain), 1.97 KB, created by Yusuke Suzuki on 2018-08-20 00:55:11 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2018-08-20 00:55:11 PDT

Size: 1.97 KB

patch

obsolete

>Subversion Revision: 235024
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 8f4f3380b9d68081f14b45a5cc53d3b70983ff91..6d54dc0b1063a25de93c98d41d9c21836173797e 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,17 @@
>+2018-08-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
>+
>+        [JSC] HeapUtil should care pointer overflow
>+        https://bugs.webkit.org/show_bug.cgi?id=188740
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        `pointer - sizeof(IndexingHeader) - 1` causes an undefined behavior if a pointer is overflow.
>+        For example, if `pointer` is nullptr, it causes pointer overflow. Instead of calculating this
>+        with `char*` pointer, we cast it to `uintptr_t` temporarily. This issue is found by UBSan.
>+
>+        * heap/HeapUtil.h:
>+        (JSC::HeapUtil::findGCObjectPointersForMarking):
>+
> 2018-08-19  Carlos Garcia Campos  <cgarcia@igalia.com>
> 
>         [GLIB] Add API to throw exceptions using printf formatted strings
>diff --git a/Source/JavaScriptCore/heap/HeapUtil.h b/Source/JavaScriptCore/heap/HeapUtil.h
>index 9ef03ea6fcd987d4a98fc7eb19444d1085cc0d05..f94df03c1beed1850a8a3f1e90b6ec80f927a2ed 100644
>--- a/Source/JavaScriptCore/heap/HeapUtil.h
>+++ b/Source/JavaScriptCore/heap/HeapUtil.h
>@@ -84,7 +84,7 @@ class HeapUtil {
>         // It's possible for a butterfly pointer to point past the end of a butterfly. Check this now.
>         if (pointer <= bitwise_cast<char*>(candidate) + sizeof(IndexingHeader)) {
>             // We may be interested in the last cell of the previous MarkedBlock.
>-            char* previousPointer = pointer - sizeof(IndexingHeader) - 1;
>+            char* previousPointer = bitwise_cast<char*>(bitwise_cast<uintptr_t>(pointer) - sizeof(IndexingHeader) - 1);
>             MarkedBlock* previousCandidate = MarkedBlock::blockFor(previousPointer);
>             if (!filter.ruleOut(bitwise_cast<Bits>(previousCandidate))
>                 && set.contains(previousCandidate)

Flags:

saam: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 188740: 347485