From cf26dce826a7a6a2d14735c193c53b9103c4a369 Mon Sep 17 00:00:00 2001 From: Filip Pizlo Date: Thu, 25 Sep 2014 11:29:50 +0200 Subject: compileMakeRope does not emit necessary bounds checks https://bugs.webkit.org/show_bug.cgi?id=130684 Reviewed by Oliver Hunt. Add string length bounds checks in a bunch of places. We should never allow a string to have a length greater than 2^31-1 because it's not clear that the language has semantics for it and because there is code that assumes that this cannot happen. Also add a bunch of tests to that effect to cover the various ways in which this was previously allowed to happen. * dfg/DFGOperations.cpp: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileMakeRope): * ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::compileMakeRope): * runtime/JSString.cpp: (JSC::JSRopeString::RopeBuilder::expand): * runtime/JSString.h: (JSC::JSString::create): (JSC::JSRopeString::RopeBuilder::append): (JSC::JSRopeString::RopeBuilder::release): (JSC::JSRopeString::append): * runtime/Operations.h: (JSC::jsString): (JSC::jsStringFromRegisterArray): (JSC::jsStringFromArguments): * runtime/StringPrototype.cpp: (JSC::stringProtoFuncIndexOf): (JSC::stringProtoFuncSlice): (JSC::stringProtoFuncSubstring): (JSC::stringProtoFuncToLowerCase): * tests/stress/make-large-string-jit-strcat.js: Added. (foo): * tests/stress/make-large-string-jit.js: Added. (foo): * tests/stress/make-large-string-strcat.js: Added. * tests/stress/make-large-string.js: Added. Change-Id: If01dd2a2d2daa3d209eddf0213d2b391e94f54a0 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167336 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte --- Source/JavaScriptCore/runtime/JSString.h | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'Source/JavaScriptCore/runtime/JSString.h') diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h index 855de974d..fc383b2f4 100644 --- a/Source/JavaScriptCore/runtime/JSString.h +++ b/Source/JavaScriptCore/runtime/JSString.h @@ -1,7 +1,7 @@ /* * Copyright (C) 1999-2001 Harri Porten (porten@kde.org) * Copyright (C) 2001 Peter Kelly (pmk@post.com) - * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved. + * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2014 Apple Inc. All rights reserved. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Library General Public @@ -121,7 +121,8 @@ public: static JSString* create(VM& vm, PassRefPtr value) { ASSERT(value); - size_t length = value->length(); + int32_t length = value->length(); + RELEASE_ASSERT(length >= 0); size_t cost = value->cost(); JSString* newString = new (NotNull, allocateCell(vm.heap)) JSString(vm, value); newString->finishCreation(vm, length, cost); @@ -226,15 +227,21 @@ class JSRopeString : public JSString { { } - void append(JSString* jsString) + bool append(JSString* jsString) { if (m_index == JSRopeString::s_maxInternalRopeLength) expand(); + if (static_cast(m_jsString->length() + jsString->length()) < 0) { + m_jsString = 0; + return false; + } m_jsString->append(m_vm, m_index++, jsString); + return true; } JSRopeString* release() { + RELEASE_ASSERT(m_jsString); JSRopeString* tmp = m_jsString; m_jsString = 0; return tmp; @@ -284,6 +291,7 @@ private: { m_fibers[index].set(vm, this, jsString); m_length += jsString->m_length; + RELEASE_ASSERT(static_cast(m_length) >= 0); setIs8Bit(is8Bit() && jsString->is8Bit()); } -- cgit v1.2.1