Skip to content

Commit

Permalink
ASAN: Fix global-buffer-overflow @wtf::StringImpl::createFromLiteral()
Browse files Browse the repository at this point in the history
strlen() is invoked on strings located in UserAgentStyleSheetsData.cpp,
however strings in those tables doesn't not contain valid C string with
'\0' character in the end.

GDB callstack excerpt:
(complete is available at WebPlatformForEmbedded#592)

(gdb) bt
(gdb) bt

(gdb) fr 4
158	    return createFromLiteral(characters, strlen(characters));
(gdb) l
153	    return adoptRef(*new StringImpl(reinterpret_cast<const LChar*>(characters), length, ConstructWithoutCopying));
154	}
155
156	Ref<StringImpl> StringImpl::createFromLiteral(const char* characters)
157	{
158	    return createFromLiteral(characters, strlen(characters));
159	}

Signed-off-by: Damian Wrobel <dwrobel@ertelnet.rybnik.pl>
  • Loading branch information
dwrobel committed Apr 10, 2019
1 parent 2371327 commit bea8fa6
Showing 1 changed file with 7 additions and 6 deletions.
13 changes: 7 additions & 6 deletions Source/WebCore/css/make-css-file-arrays.pl
Original file line number Diff line number Diff line change
Expand Up @@ -66,11 +66,11 @@
# Write out a C array of the characters.
my $length = length $text;
if ($in =~ /(\w+)\.css$/) {
print HEADER "extern const char ${name}UserAgentStyleSheet[${length}];\n";
print OUT "extern const char ${name}UserAgentStyleSheet[${length}] = {\n";
print HEADER "extern const char ${name}UserAgentStyleSheet[${length}+1];\n";
print OUT "extern const char ${name}UserAgentStyleSheet[${length}+1] = {\n";
} else {
print HEADER "extern const char ${name}JavaScript[${length}];\n";
print OUT "extern const char ${name}JavaScript[${length}] = {\n";
print HEADER "extern const char ${name}JavaScript[${length}+1];\n";
print OUT "extern const char ${name}JavaScript[${length}+1] = {\n";
}
my $i = 0;
while ($i < $length) {
Expand All @@ -82,9 +82,10 @@
++$i;
++$j;
}
print OUT "," unless $i == $length;
print OUT "\n";
print OUT ",";
print OUT "\n" unless $i == $length;
}
print OUT " 0\n";
print OUT "};\n";

}
Expand Down

0 comments on commit bea8fa6

Please sign in to comment.