Skip to content

Commit

Permalink
Removing unbounded resize of Vector
Browse files Browse the repository at this point in the history
https://bugs.webkit.org/show_bug.cgi?id=272491
rdar://126132559

Reviewed by Alex Christensen.

Resize the vector with an option to fallback to default value.
Test Case has been added to verify the fix.

* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::readRTCCertificate):
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebCore/SerializedScriptValue.cpp: Added.
(TestWebKitAPI::TEST):

Canonical link: https://commits.webkit.org/272448.906@safari-7618-branch
  • Loading branch information
Nitin Mahendru authored and Pascoe committed Apr 12, 2024
1 parent 5e1f73f commit cb2f032
Show file tree
Hide file tree
Showing 3 changed files with 79 additions and 1 deletion.
3 changes: 2 additions & 1 deletion Source/WebCore/bindings/js/SerializedScriptValue.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -4358,7 +4358,8 @@ class CloneDeserializer : public CloneBase {
return JSValue();

Vector<RTCCertificate::DtlsFingerprint> fingerprints;
fingerprints.reserveInitialCapacity(size);
if (!fingerprints.tryReserveInitialCapacity(size))
return JSValue();
for (unsigned i = 0; i < size; i++) {
CachedStringRef algorithm;
if (!readStringData(algorithm))
Expand Down
4 changes: 4 additions & 0 deletions Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
Original file line number Diff line number Diff line change
Expand Up @@ -868,6 +868,7 @@
93F79A5B28E64A07003E7CEB /* websql-database.db in Copy Resources */ = {isa = PBXBuildFile; fileRef = 93F79A5128E649EB003E7CEB /* websql-database.db */; };
93F7E86F14DC8E5C00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F7E86E14DC8E5B00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp */; };
93FCDB34263631560046DD7D /* SortedArrayMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93FCDB33263631560046DD7D /* SortedArrayMap.cpp */; };
946422142BC83114001B42B3 /* SerializedScriptValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9464220C2BC8306D001B42B3 /* SerializedScriptValue.cpp */; };
95194CC028A5811F00343FDE /* red.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 95194CBF28A580E900343FDE /* red.html */; };
9528E5FD279A0341008ADFEF /* BundleCSSStyleDeclarationHandlePlugIn.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9528E5FC279A0338008ADFEF /* BundleCSSStyleDeclarationHandlePlugIn.mm */; };
952F7167270BD9CB00D00DCC /* CSSViewportUnits.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 952F7166270BD99700D00DCC /* CSSViewportUnits.html */; };
Expand Down Expand Up @@ -3008,6 +3009,7 @@
93F7E86B14DC8E4D00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NewFirstVisuallyNonEmptyLayoutFrames.cpp; sourceTree = "<group>"; };
93F7E86E14DC8E5B00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp; sourceTree = "<group>"; };
93FCDB33263631560046DD7D /* SortedArrayMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SortedArrayMap.cpp; sourceTree = "<group>"; };
9464220C2BC8306D001B42B3 /* SerializedScriptValue.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = SerializedScriptValue.cpp; sourceTree = "<group>"; };
95095F1F262FFFA50000D920 /* SampledPageTopColor.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SampledPageTopColor.mm; sourceTree = "<group>"; };
950E4CC0252E75230071659F /* iOSStylusSupport.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = iOSStylusSupport.mm; sourceTree = "<group>"; };
95194CBF28A580E900343FDE /* red.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; path = red.html; sourceTree = "<group>"; };
Expand Down Expand Up @@ -4422,6 +4424,7 @@
4181C62C255A891100AEB0FF /* RTCRtpSFrameTransformerTests.cpp */,
CDCFA7A91E45122F00C2433D /* SampleMap.cpp */,
CE06DF9A1E1851F200E570C9 /* SecurityOrigin.cpp */,
9464220C2BC8306D001B42B3 /* SerializedScriptValue.cpp */,
4102EE1627845ED500D6BE74 /* ServiceWorkerRoutines.cpp */,
41973B5C1AF22875006C7B36 /* SharedBuffer.cpp */,
A17991891E1CA24100A505ED /* SharedBufferTest.cpp */,
Expand Down Expand Up @@ -6685,6 +6688,7 @@
1C90420C2326E03C00BEF91E /* SelectionByWord.mm in Sources */,
9B4B5EA522DEBE19001E3D5A /* SelectionModifyByParagraphBoundary.mm in Sources */,
5769C50B1D9B0002000847FB /* SerializedCryptoKeyWrap.mm in Sources */,
946422142BC83114001B42B3 /* SerializedScriptValue.cpp in Sources */,
4102EE1727845ED500D6BE74 /* ServiceWorkerRoutines.cpp in Sources */,
7CCE7ECB1A411A7E00447C4C /* SetAndUpdateCacheModel.mm in Sources */,
7CCE7ECC1A411A7E00447C4C /* SetDocumentURI.mm in Sources */,
Expand Down
73 changes: 73 additions & 0 deletions Tools/TestWebKitAPI/Tests/WebCore/SerializedScriptValue.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
/*
* Copyright (C) 2024 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
* THE POSSIBILITY OF SUCH DAMAGE.
*/

#include "config.h"

#include <JavaScriptCore/InitializeThreading.h>
#include <JavaScriptCore/JSCJSValue.h>
#include <WebCore/IDBBindingUtilities.h>
#include <WebCore/IDBValue.h>
#include <WebCore/ParsedContentRange.h>
#include <WebCore/ParsedRequestRange.h>
#include <WebCore/ProcessIdentifier.h>
#include <WebCore/ThreadSafeDataBuffer.h>
#include <wtf/text/WTFString.h>

using namespace WebCore;

namespace TestWebKitAPI {

TEST(WebCore, SerializedScriptValueReadRTCCertificate)
{
WTF::initialize();
WTF::initializeMainThread();
JSC::initialize();
WebCore::Process::identifier();

std::array<uint8_t, 149> bytes {
0x0d, 0x00, 0x00, 0x00, 0x2c, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0xe7, 0x1b, 0x86, 0xc8, 0xd0, 0xdb, 0x71, 0x6a, 0xac, 0x80, 0xf4,
0x6f, 0x76, 0xc0, 0x35, 0x5c, 0xc8, 0xc0, 0x4e, 0x49, 0xd8, 0xc4, 0x6d,
0x9c, 0x4e, 0x3f, 0xbd, 0x9e, 0xdc, 0xe5, 0xcd, 0x81, 0x5e, 0x71, 0x14,
0xb3, 0x1a, 0xad, 0xa3, 0xf5, 0xcf, 0x1f, 0x82, 0x58, 0xd8, 0xca, 0xbe,
0xb1, 0x2c, 0xd9, 0xef, 0xde, 0x05, 0x26, 0xef, 0xdc, 0x21, 0x4f, 0x3d,
0x20, 0x00, 0x32, 0x4b, 0xd8, 0x85, 0x86, 0xf4, 0x68, 0xb7, 0x1f, 0x71,
0xa7, 0xd8, 0x5e, 0x50, 0xcf, 0x9e, 0xc6, 0x91, 0x44, 0x36, 0x41, 0xdc,
0x54, 0x68, 0xc8, 0xf8, 0x5f, 0x93, 0xb4, 0x07, 0xfa, 0x73, 0xd7, 0x90,
0xa8, 0x9f, 0x07, 0xd2, 0x50, 0x03, 0x5e, 0x05, 0x77, 0x4a, 0x56, 0xdd,
0x1e, 0x68, 0xd3, 0x62, 0x8f, 0x58, 0x7e, 0x7c, 0x1e, 0xc6, 0x0f, 0xcc,
0x01, 0x6e, 0x88, 0x4b, 0x32
};

Vector<uint8_t> vector { std::span<uint8_t>(bytes) };
const WebCore::ThreadSafeDataBuffer value = WebCore::ThreadSafeDataBuffer::create(WTFMove(vector));
WebCore::callOnIDBSerializationThreadAndWait([&](auto& globalObject) {
auto jsValue = WebCore::deserializeIDBValueToJSValue(globalObject, value);
UNUSED_VARIABLE(jsValue);
});
}

}

0 comments on commit cb2f032

Please sign in to comment.