198101 2019-05-21 20:39:35 -0700 [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes 2019-05-22 10:22:54 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ysuzuki ysuzuki commit-queue ews-watchlist keith_miller mark.lam msaboff saam webkit-bug-importer oldest_to_newest 1538112 0 ysuzuki 2019-05-21 20:39:35 -0700 But we have some special path for 0 bytes. In this case, allocation size and sizeInBytes become different => authentication failure. 1538113 1 ysuzuki 2019-05-21 20:40:25 -0700 <rdar://problem/50754184> 1538114 2 370377 ysuzuki 2019-05-21 20:45:58 -0700 Created attachment 370377 Patch WIP, checking that this actually fixes the issue 1538146 3 370390 ysuzuki 2019-05-22 02:42:20 -0700 Created attachment 370390 Patch 1538196 4 370390 msaboff 2019-05-22 08:59:05 -0700 Comment on attachment 370390 Patch r=me 1538235 5 370390 ysuzuki 2019-05-22 10:09:55 -0700 Comment on attachment 370390 Patch Thanks! 1538241 6 370390 commit-queue 2019-05-22 10:21:26 -0700 Comment on attachment 370390 Patch Clearing flags on attachment: 370390 Committed r245622: <https://trac.webkit.org/changeset/245622> 1538242 7 commit-queue 2019-05-22 10:21:28 -0700 All reviewed patches have been landed. Closing bug. 1538243 8 370390 keith_miller 2019-05-22 10:22:54 -0700 Comment on attachment 370390 Patch Whoops! That would do it... 370377 2019-05-21 20:45:58 -0700 2019-05-22 02:42:19 -0700 Patch bug-198101-20190521204557.patch text/plain 2417 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ1NTg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBh ZTBmNmViMjkxMjViYjEyMTA1NGIyZDM3NWNhOWYwY2JmNjFmMDI2Li5iNmE4ODZhMzQyMjJiY2Ew MGViNTIyNjYzMmU3M2FkYzBiZTFmOWE4IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMyBAQAorMjAxOS0wNS0yMSAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29t PgorCisgICAgICAgIFtKU0NdIEFycmF5QnVmZmVyQ29udGVudHM6OnRyeUFsbG9jYXRlIHNpZ25z IHRoZSBwb2ludGVyIHdpdGggYWxsb2NhdGlvbiBzaXplIGFuZCBhdXRoZW50aWNhdGVzIGl0IHdp dGggc2l6ZUluQnl0ZXMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTE5ODEwMQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgICogcnVudGltZS9BcnJheUJ1ZmZlci5jcHA6CisgICAgICAgIChKU0M6OkFycmF5QnVm ZmVyQ29udGVudHM6OnRyeUFsbG9jYXRlKToKKwogMjAxOS0wNS0yMSAgS2VpdGggTWlsbGVyICA8 a2VpdGhfbWlsbGVyQGFwcGxlLmNvbT4KIAogICAgICAgICBVbnJldmlld2VkIGJ1aWxkIGZpeCBh ZGQgVU5VU0VEX1BBUkFNLgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRp bWUvQXJyYXlCdWZmZXIuY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlC dWZmZXIuY3BwCmluZGV4IGIxNmVjMzhmNjViMzk3ZGEyOTNjOGZmN2RlZWNjZTRjMTE2MWE2N2Uu LjY3MWJkYjc3MTMyZmE2OWYxZTE0Zjc1ZDNiZDc2NmJiNjE0YzhhNmEgMTAwNjQ0Ci0tLSBhL1Nv dXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0FycmF5QnVmZmVyLmNwcAorKysgYi9Tb3VyY2Uv SmF2YVNjcmlwdENvcmUvcnVudGltZS9BcnJheUJ1ZmZlci5jcHAKQEAgLTEwNiwyMSArMTA2LDIy IEBAIHZvaWQgQXJyYXlCdWZmZXJDb250ZW50czo6dHJ5QWxsb2NhdGUodW5zaWduZWQgbnVtRWxl bWVudHMsIHVuc2lnbmVkIGVsZW1lbnRCeXRlCiAgICAgICAgICAgICByZXR1cm47CiAgICAgICAg IH0KICAgICB9Ci0gICAgc2l6ZV90IHNpemUgPSBzdGF0aWNfY2FzdDxzaXplX3Q+KG51bUVsZW1l bnRzKSAqIHN0YXRpY19jYXN0PHNpemVfdD4oZWxlbWVudEJ5dGVTaXplKTsKLSAgICBpZiAoIXNp emUpCi0gICAgICAgIHNpemUgPSAxOyAvLyBNYWtlIHN1cmUgbWFsbG9jIGFjdHVhbGx5IGFsbG9j YXRlcyBzb21ldGhpbmcsIGJ1dCBub3QgdG9vIG11Y2guIFdlIHVzZSBudWxsIHRvIG1lYW4gdGhh dCB0aGUgYnVmZmVyIGlzIG5ldXRlcmVkLgorICAgIHNpemVfdCBzaXplSW5CeXRlcyA9IHN0YXRp Y19jYXN0PHNpemVfdD4obnVtRWxlbWVudHMpICogc3RhdGljX2Nhc3Q8c2l6ZV90PihlbGVtZW50 Qnl0ZVNpemUpOworICAgIHNpemVfdCBhbGxvY2F0aW9uU2l6ZSA9IHNpemVJbkJ5dGVzOworICAg IGlmICghYWxsb2NhdGlvblNpemUpCisgICAgICAgIGFsbG9jYXRpb25TaXplID0gMTsgLy8gTWFr ZSBzdXJlIG1hbGxvYyBhY3R1YWxseSBhbGxvY2F0ZXMgc29tZXRoaW5nLCBidXQgbm90IHRvbyBt dWNoLiBXZSB1c2UgbnVsbCB0byBtZWFuIHRoYXQgdGhlIGJ1ZmZlciBpcyBuZXV0ZXJlZC4KIAot ICAgIHZvaWQqIGRhdGEgPSBHaWdhY2FnZTo6dHJ5TWFsbG9jKEdpZ2FjYWdlOjpQcmltaXRpdmUs IG51bUVsZW1lbnRzICogZWxlbWVudEJ5dGVTaXplKTsKLSAgICBtX2RhdGEgPSBEYXRhVHlwZShk YXRhLCBzaXplKTsKKyAgICB2b2lkKiBkYXRhID0gR2lnYWNhZ2U6OnRyeU1hbGxvYyhHaWdhY2Fn ZTo6UHJpbWl0aXZlLCBhbGxvY2F0aW9uU2l6ZSk7CisgICAgbV9kYXRhID0gRGF0YVR5cGUoZGF0 YSwgc2l6ZUluQnl0ZXMpOwogICAgIGlmICghZGF0YSkgewogICAgICAgICByZXNldCgpOwogICAg ICAgICByZXR1cm47CiAgICAgfQogICAgIAogICAgIGlmIChwb2xpY3kgPT0gWmVyb0luaXRpYWxp emUpCi0gICAgICAgIG1lbXNldChkYXRhLCAwLCBzaXplKTsKKyAgICAgICAgbWVtc2V0KGRhdGEs IDAsIGFsbG9jYXRpb25TaXplKTsKIAotICAgIG1fc2l6ZUluQnl0ZXMgPSBudW1FbGVtZW50cyAq IGVsZW1lbnRCeXRlU2l6ZTsKKyAgICBtX3NpemVJbkJ5dGVzID0gc2l6ZUluQnl0ZXM7CiAgICAg UkVMRUFTRV9BU1NFUlQobV9zaXplSW5CeXRlcyA8PSBNQVhfQVJSQVlfQlVGRkVSX1NJWkUpOwog ICAgIG1fZGVzdHJ1Y3RvciA9IFtdICh2b2lkKiBwKSB7IEdpZ2FjYWdlOjpmcmVlKEdpZ2FjYWdl OjpQcmltaXRpdmUsIHApOyB9OwogfQo= 370390 2019-05-22 02:42:20 -0700 2019-05-22 10:21:26 -0700 Patch bug-198101-20190522024219.patch text/plain 4467 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ1NjEzCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAx YTc3MDg0ZTY0ZTU1NmY1M2E0MDEzMGRmMGE4MjdlMGMyMjg3NmJmLi40YmZmNDdjN2FhMDBhOGQ4 MjUzZmI2OGZiMjg4YWY3Y2I5ZTBiNWI5IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwyMSBAQAorMjAxOS0wNS0yMiAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29t PgorCisgICAgICAgIFtKU0NdIEFycmF5QnVmZmVyQ29udGVudHM6OnRyeUFsbG9jYXRlIHNpZ25z IHRoZSBwb2ludGVyIHdpdGggYWxsb2NhdGlvbiBzaXplIGFuZCBhdXRoZW50aWNhdGVzIGl0IHdp dGggc2l6ZUluQnl0ZXMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTE5ODEwMQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIFdoZW4gd2UgYWxsb2NhdGUgMC1sZW5ndGggQXJyYXlCdWZmZXIsIHdlIGFsbG9jYXRl IDEgYnl0ZSBzdG9yYWdlIGluc3RlYWQgYmVjYXVzZSB3ZSB3b3VsZCBsaWtlIHRvIGVuc3VyZSB0 aGF0CisgICAgICAgIG5vbi1uZXV0ZXJlZCBBcnJheUJ1ZmZlciBhbHdheXMgaGF2ZSBub24gbnVs bHB0ci4gV2hpbGUgd2UgYWxsb2NhdGUgYSAxIGJ5dGUgc3RvcmFnZSwgdGhpcyBBcnJheUJ1ZmZl ciBzYXlzCisgICAgICAgIHNpemVJbkJ5dGVzID0gMC4gSG93ZXZlciwgd2UgYWNjaWRlbnRhbGx5 IGNvbmZpZ3VyZSB0aGUgdmVjdG9yIHBvaW50ZXIgd2l0aCB0aGlzIDEgYnl0ZSBzaXplIGluIHRo ZSBjb25zdHJ1Y3Rvci4KKyAgICAgICAgSW4gQVJNNjRFIGRldmljZSwgd2Ugc2lnbiB0aGUgdmVj dG9yIHBvaW50ZXIgd2l0aCBtb2RpZmllciA9IDEgKDEgYnl0ZSBzaXplKSwgYW5kIGxhdGVyIHdl IGF1dGhlbnRpY2F0ZSB0aGlzCisgICAgICAgIHBvaW50ZXIgd2l0aCBtb2RpZmllciA9IDAgKHNp emVJbkJ5dGVzKSwgYW5kIGZhaWwgdG8gYXV0aGVudGljYXRlIHRoZSBwb2ludGVyLgorCisgICAg ICAgIEluIHRoaXMgcGF0Y2gsIHdlIHNpZ24gdGhlIHBvaW50ZXIgd2l0aCBzaXplSW5CeXRlcyBz byB0aGF0IHdlIGNvcnJlY3RseSBhdXRoZW50aWNhdGUgdGhlIDAgYnl0ZXMgdmVjdG9yIHBvaW50 ZXIuCisKKyAgICAgICAgKiBydW50aW1lL0FycmF5QnVmZmVyLmNwcDoKKyAgICAgICAgKEpTQzo6 QXJyYXlCdWZmZXJDb250ZW50czo6dHJ5QWxsb2NhdGUpOgorCiAyMDE5LTA1LTIxICBSb3NzIEtp cnNsaW5nICA8cm9zcy5raXJzbGluZ0Bzb255LmNvbT4KIAogICAgICAgICBbUGxheVN0YXRpb25d IERvbid0IGNhbGwgZmNudGwuCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVu dGltZS9BcnJheUJ1ZmZlci5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9BcnJh eUJ1ZmZlci5jcHAKaW5kZXggYjE2ZWMzOGY2NWIzOTdkYTI5M2M4ZmY3ZGVlY2NlNGMxMTYxYTY3 ZS4uNjcxYmRiNzcxMzJmYTY5ZjFlMTRmNzVkM2JkNzY2YmI2MTRjOGE2YSAxMDA2NDQKLS0tIGEv U291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlCdWZmZXIuY3BwCisrKyBiL1NvdXJj ZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0FycmF5QnVmZmVyLmNwcApAQCAtMTA2LDIxICsxMDYs MjIgQEAgdm9pZCBBcnJheUJ1ZmZlckNvbnRlbnRzOjp0cnlBbGxvY2F0ZSh1bnNpZ25lZCBudW1F bGVtZW50cywgdW5zaWduZWQgZWxlbWVudEJ5dGUKICAgICAgICAgICAgIHJldHVybjsKICAgICAg ICAgfQogICAgIH0KLSAgICBzaXplX3Qgc2l6ZSA9IHN0YXRpY19jYXN0PHNpemVfdD4obnVtRWxl bWVudHMpICogc3RhdGljX2Nhc3Q8c2l6ZV90PihlbGVtZW50Qnl0ZVNpemUpOwotICAgIGlmICgh c2l6ZSkKLSAgICAgICAgc2l6ZSA9IDE7IC8vIE1ha2Ugc3VyZSBtYWxsb2MgYWN0dWFsbHkgYWxs b2NhdGVzIHNvbWV0aGluZywgYnV0IG5vdCB0b28gbXVjaC4gV2UgdXNlIG51bGwgdG8gbWVhbiB0 aGF0IHRoZSBidWZmZXIgaXMgbmV1dGVyZWQuCisgICAgc2l6ZV90IHNpemVJbkJ5dGVzID0gc3Rh dGljX2Nhc3Q8c2l6ZV90PihudW1FbGVtZW50cykgKiBzdGF0aWNfY2FzdDxzaXplX3Q+KGVsZW1l bnRCeXRlU2l6ZSk7CisgICAgc2l6ZV90IGFsbG9jYXRpb25TaXplID0gc2l6ZUluQnl0ZXM7Cisg ICAgaWYgKCFhbGxvY2F0aW9uU2l6ZSkKKyAgICAgICAgYWxsb2NhdGlvblNpemUgPSAxOyAvLyBN YWtlIHN1cmUgbWFsbG9jIGFjdHVhbGx5IGFsbG9jYXRlcyBzb21ldGhpbmcsIGJ1dCBub3QgdG9v IG11Y2guIFdlIHVzZSBudWxsIHRvIG1lYW4gdGhhdCB0aGUgYnVmZmVyIGlzIG5ldXRlcmVkLgog Ci0gICAgdm9pZCogZGF0YSA9IEdpZ2FjYWdlOjp0cnlNYWxsb2MoR2lnYWNhZ2U6OlByaW1pdGl2 ZSwgbnVtRWxlbWVudHMgKiBlbGVtZW50Qnl0ZVNpemUpOwotICAgIG1fZGF0YSA9IERhdGFUeXBl KGRhdGEsIHNpemUpOworICAgIHZvaWQqIGRhdGEgPSBHaWdhY2FnZTo6dHJ5TWFsbG9jKEdpZ2Fj YWdlOjpQcmltaXRpdmUsIGFsbG9jYXRpb25TaXplKTsKKyAgICBtX2RhdGEgPSBEYXRhVHlwZShk YXRhLCBzaXplSW5CeXRlcyk7CiAgICAgaWYgKCFkYXRhKSB7CiAgICAgICAgIHJlc2V0KCk7CiAg ICAgICAgIHJldHVybjsKICAgICB9CiAgICAgCiAgICAgaWYgKHBvbGljeSA9PSBaZXJvSW5pdGlh bGl6ZSkKLSAgICAgICAgbWVtc2V0KGRhdGEsIDAsIHNpemUpOworICAgICAgICBtZW1zZXQoZGF0 YSwgMCwgYWxsb2NhdGlvblNpemUpOwogCi0gICAgbV9zaXplSW5CeXRlcyA9IG51bUVsZW1lbnRz ICogZWxlbWVudEJ5dGVTaXplOworICAgIG1fc2l6ZUluQnl0ZXMgPSBzaXplSW5CeXRlczsKICAg ICBSRUxFQVNFX0FTU0VSVChtX3NpemVJbkJ5dGVzIDw9IE1BWF9BUlJBWV9CVUZGRVJfU0laRSk7 CiAgICAgbV9kZXN0cnVjdG9yID0gW10gKHZvaWQqIHApIHsgR2lnYWNhZ2U6OmZyZWUoR2lnYWNh Z2U6OlByaW1pdGl2ZSwgcCk7IH07CiB9CmRpZmYgLS1naXQgYS9KU1Rlc3RzL0NoYW5nZUxvZyBi L0pTVGVzdHMvQ2hhbmdlTG9nCmluZGV4IDRlNGY4ODY1NmFjODRhM2JjMGJmNzI2ZWJmMzU0Mzlk OTFlMzA1YWQuLjNlN2IyNDRiYzcwMDZjMGU4ZDVlNzVhZmZmMDdhNWRhYTJmNDViN2IgMTAwNjQ0 Ci0tLSBhL0pTVGVzdHMvQ2hhbmdlTG9nCisrKyBiL0pTVGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMg KzEsMTMgQEAKKzIwMTktMDUtMjIgIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4K KworICAgICAgICBbSlNDXSBBcnJheUJ1ZmZlckNvbnRlbnRzOjp0cnlBbGxvY2F0ZSBzaWducyB0 aGUgcG9pbnRlciB3aXRoIGFsbG9jYXRpb24gc2l6ZSBhbmQgYXV0aGVudGljYXRlcyBpdCB3aXRo IHNpemVJbkJ5dGVzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xOTgxMDEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg ICAgICAqIHN0cmVzcy96ZXJvLXNpemVkLWFycmF5LWJ1ZmZlci1wb2ludGVyLXNob3VsZC1iZS1z aWduZWQtd2l0aC16ZXJvLmpzOiBBZGRlZC4KKyAgICAgICAgKHNob3VsZEJlKToKKwogMjAxOS0w NS0yMCAgS2VpdGggTWlsbGVyICA8a2VpdGhfbWlsbGVyQGFwcGxlLmNvbT4KIAogICAgICAgICBD bGVhbnVwIFlhcnIgcmVnZXhwIGNvZGUgYXJvdW5kIHBhcmVuIGNvbnRleHRzLgpkaWZmIC0tZ2l0 IGEvSlNUZXN0cy9zdHJlc3MvemVyby1zaXplZC1hcnJheS1idWZmZXItcG9pbnRlci1zaG91bGQt YmUtc2lnbmVkLXdpdGgtemVyby5qcyBiL0pTVGVzdHMvc3RyZXNzL3plcm8tc2l6ZWQtYXJyYXkt YnVmZmVyLXBvaW50ZXItc2hvdWxkLWJlLXNpZ25lZC13aXRoLXplcm8uanMKbmV3IGZpbGUgbW9k ZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4u NTU4N2QwMjA2MmNlMzQxN2ZiZTExN2FmYmE1NTRiNzJiNDAyNWI3MwotLS0gL2Rldi9udWxsCisr KyBiL0pTVGVzdHMvc3RyZXNzL3plcm8tc2l6ZWQtYXJyYXktYnVmZmVyLXBvaW50ZXItc2hvdWxk LWJlLXNpZ25lZC13aXRoLXplcm8uanMKQEAgLTAsMCArMSw5IEBACitmdW5jdGlvbiBzaG91bGRC ZShhY3R1YWwsIGV4cGVjdGVkKSB7CisgICAgaWYgKGFjdHVhbCAhPT0gZXhwZWN0ZWQpCisgICAg ICAgIHRocm93IG5ldyBFcnJvcignYmFkIHZhbHVlOiAnICsgYWN0dWFsKTsKK30KKwordmFyIHR5 cGVkQXJyYXkgPSBuZXcgSW50OEFycmF5KCk7CitzaG91bGRCZSh0eXBlZEFycmF5Lmxlbmd0aCwg MCk7Cit2YXIgc3ViYXJyYXkgPSB0eXBlZEFycmF5LnN1YmFycmF5KDAsIDApOworc2hvdWxkQmUo c3ViYXJyYXkubGVuZ3RoLCAwKTsK