Bug 187444

Summary: PropertyTable::skipDeletedEntries() should guard against iterating past the table end.
Product: WebKit Reporter: Mark Lam <mark.lam>
Component: JavaScriptCoreAssignee: Mark Lam <mark.lam>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, fpizlo, keith_miller, msaboff, rmorisset, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
proposed patch.
mark.lam: review-
proposed patch. none

Description Mark Lam 2018-07-08 00:35:34 PDT 
PropertyTable supports C++ iteration by offering begin() and end() methods, and an iterator class.  The begin() methods and the iterator operator++() method uses PropertyTable::skipDeletedEntries() to skip over deleted entries in the table.  However, PropertyTable::skipDeletedEntries() does not prevent the iteration pointer from being incremented past the end of the table.  As a result, we can iterate past the end of the table.  Note that the C++ iteration protocol tests for the iterator not being equal to the end() value.  It does not do a <= test.  If the iterator ever shoots past end, the loop will effectively not terminate.

This issue can manifest if and only if the last entry in the table is a deleted one.

<rdar://problem/41282849>
Comment 1 Mark Lam 2018-07-08 01:11:47 PDT 
Created attachment 344540 [details]
proposed patch.
Comment 2 Mark Lam 2018-07-08 01:14:48 PDT 
Created attachment 344541 [details]
proposed patch.
Comment 3 Saam Barati 2018-07-08 01:58:58 PDT 
Comment on attachment 344541 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=344541&action=review

> Source/JavaScriptCore/ChangeLog:18
> +        This issue can manifest if and only if the last entry in the table is a deleted

Crazy
Comment 4 Mark Lam 2018-07-08 02:27:25 PDT 
Comment on attachment 344541 [details]
proposed patch.

Thanks for the review.  Landing.
Comment 5 WebKit Commit Bot 2018-07-08 02:54:57 PDT 
Comment on attachment 344541 [details]
proposed patch.

Clearing flags on attachment: 344541

Committed r233625: <https://trac.webkit.org/changeset/233625>
Comment 6 WebKit Commit Bot 2018-07-08 02:54:59 PDT 
All reviewed patches have been landed.  Closing bug.