Reviewers: Hablich,
Description:
Version 4.4.63.17 (cherry-pick)
Merged b199bcdd47ae97ec116b430e34ab42001c8f04c0
unicode-decoder: fix out-of-band write in utf16
BUG=v8:4274,chromium:508540
LOG=N
TBR=habl...@chromium.org
Please review this at https://codereview.chromium.org/1227203010/
Base URL: https://chromium.googlesource.com/v8/v8.git@4.4
Affected files (+65, -6 lines):
M include/v8-version.h
M src/unicode-decoder.h
M src/unicode-decoder.cc
M test/cctest/test-api.cc
Index: include/v8-version.h
diff --git a/include/v8-version.h b/include/v8-version.h
index
6087c8870d5508c4d2de14ee64f4e85998a6a6e5..c01824261b2f3548bd73f4ea4c8f19045c948028
100644
--- a/include/v8-version.h
+++ b/include/v8-version.h
@@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 4
#define V8_MINOR_VERSION 4
#define V8_BUILD_NUMBER 63
-#define V8_PATCH_LEVEL 16
+#define V8_PATCH_LEVEL 17
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Index: src/unicode-decoder.cc
diff --git a/src/unicode-decoder.cc b/src/unicode-decoder.cc
index
a3bf829522688b27a84b74e3322eed5a0c4088f3..2289e083425aeb1ec61fff7ca67328afa2fde1ca
100644
--- a/src/unicode-decoder.cc
+++ b/src/unicode-decoder.cc
@@ -15,6 +15,7 @@ void Utf8DecoderBase::Reset(uint16_t* buffer, size_t
buffer_length,
// Assume everything will fit in the buffer and stream won't be needed.
last_byte_of_buffer_unused_ = false;
unbuffered_start_ = NULL;
+ unbuffered_length_ = 0;
bool writing_to_buffer = true;
// Loop until stream is read, writing to buffer as long as buffer has
space.
size_t utf16_length = 0;
@@ -41,6 +42,7 @@ void Utf8DecoderBase::Reset(uint16_t* buffer, size_t
buffer_length,
// Just wrote last character of buffer
writing_to_buffer = false;
unbuffered_start_ = stream;
+ unbuffered_length_ = stream_length;
}
continue;
}
@@ -50,19 +52,23 @@ void Utf8DecoderBase::Reset(uint16_t* buffer, size_t
buffer_length,
writing_to_buffer = false;
last_byte_of_buffer_unused_ = true;
unbuffered_start_ = stream - cursor;
+ unbuffered_length_ = stream_length + cursor;
}
utf16_length_ = utf16_length;
}
-void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream, uint16_t* data,
+void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream,
+ size_t stream_length, uint16_t* data,
size_t data_length) {
while (data_length != 0) {
size_t cursor = 0;
- uint32_t character = Utf8::ValueOf(stream, Utf8::kMaxEncodedSize,
&cursor);
+ uint32_t character = Utf8::ValueOf(stream, stream_length, &cursor);
// There's a total lack of bounds checking for stream
// as it was already done in Reset.
stream += cursor;
+ DCHECK(stream_length >= cursor);
+ stream_length -= cursor;
if (character > unibrow::Utf16::kMaxNonSurrogateCharCode) {
*data++ = Utf16::LeadSurrogate(character);
*data++ = Utf16::TrailSurrogate(character);
Index: src/unicode-decoder.h
diff --git a/src/unicode-decoder.h b/src/unicode-decoder.h
index
bfb14a38555244c529761724e901aa41584d8900..c03084116603c5db734f1d471e25fa92e1106623
100644
--- a/src/unicode-decoder.h
+++ b/src/unicode-decoder.h
@@ -23,9 +23,10 @@ class Utf8DecoderBase {
// The first buffer_length utf16 chars are cached in the buffer.
void Reset(uint16_t* buffer, size_t buffer_length, const uint8_t* stream,
size_t stream_length);
- static void WriteUtf16Slow(const uint8_t* stream, uint16_t* data,
- size_t length);
+ static void WriteUtf16Slow(const uint8_t* stream, size_t stream_length,
+ uint16_t* data, size_t length);
const uint8_t* unbuffered_start_;
+ size_t unbuffered_length_;
size_t utf16_length_;
bool last_byte_of_buffer_unused_;
@@ -48,6 +49,7 @@ class Utf8Decoder : public Utf8DecoderBase {
Utf8DecoderBase::Utf8DecoderBase()
: unbuffered_start_(NULL),
+ unbuffered_length_(0),
utf16_length_(0),
last_byte_of_buffer_unused_(false) {}
@@ -84,7 +86,7 @@ size_t Utf8Decoder<kBufferSize>::WriteUtf16(uint16_t*
data,
if (length <= buffer_length) return length;
DCHECK(unbuffered_start_ != NULL);
// Copy the rest the slow way.
- WriteUtf16Slow(unbuffered_start_, data + buffer_length,
+ WriteUtf16Slow(unbuffered_start_, unbuffered_length_, data +
buffer_length,
length - buffer_length);
return length;
}
Index: test/cctest/test-api.cc
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index
6c9266b53b891fa994dfb0b3eec451840dd65fa2..35e27c3118f806a3d8a1f79450a0050e82018103
100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -7318,6 +7318,57 @@ THREADED_TEST(Utf16Symbol) {
}
+THREADED_TEST(Utf16MissingTrailing) {
+ LocalContext context;
+ v8::HandleScope scope(context->GetIsolate());
+
+ // Make sure it will go past the buffer, so it will call `WriteUtf16Slow`
+ int size = 1024 * 64;
+ uint8_t* buffer = new uint8_t[size];
+ for (int i = 0; i < size; i += 4) {
+ buffer[i] = 0xf0;
+ buffer[i + 1] = 0x9d;
+ buffer[i + 2] = 0x80;
+ buffer[i + 3] = 0x9e;
+ }
+
+ // Now invoke the decoder without last 3 bytes
+ v8::Local<v8::String> str =
+ v8::String::NewFromUtf8(
+ context->GetIsolate(), reinterpret_cast<char*>(buffer),
+ v8::NewStringType::kNormal, size - 3).ToLocalChecked();
+ USE(str);
+ delete[] buffer;
+}
+
+
+THREADED_TEST(Utf16Trailing3Byte) {
+ LocalContext context;
+ v8::HandleScope scope(context->GetIsolate());
+
+ // Make sure it will go past the buffer, so it will call `WriteUtf16Slow`
+ int size = 1024 * 63;
+ uint8_t* buffer = new uint8_t[size];
+ for (int i = 0; i < size; i += 3) {
+ buffer[i] = 0xe2;
+ buffer[i + 1] = 0x80;
+ buffer[i + 2] = 0xa6;
+ }
+
+ // Now invoke the decoder without last 3 bytes
+ v8::Local<v8::String> str =
+ v8::String::NewFromUtf8(
+ context->GetIsolate(), reinterpret_cast<char*>(buffer),
+ v8::NewStringType::kNormal, size).ToLocalChecked();
+
+ v8::String::Value value(str);
+ CHECK_EQ(value.length(), size / 3);
+ CHECK_EQ((*value)[value.length() - 1], 0x2026);
+
+ delete[] buffer;
+}
+
+
THREADED_TEST(ToArrayIndex) {
LocalContext context;
v8::Isolate* isolate = context->GetIsolate();
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
