Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 92e69a181eb3983533a720499e7248eca5351e75
https://github.com/WebKit/WebKit/commit/92e69a181eb3983533a720499e7248eca5351e75
Author: Yusuke Suzuki <[email protected]>
Date: 2025-06-05 (Thu, 05 Jun 2025)
Changed paths:
A JSTests/stress/fast-stringifier-check-string-length.js
M Source/JavaScriptCore/runtime/JSONObject.cpp
Log Message:
-----------
[JSC] Check overflow of escaped string length in FastStringifier
https://bugs.webkit.org/show_bug.cgi?id=289387
rdar://143829386
Reviewed by Yijia Huang.
Multiplying with 6 can cause overflow for unsigned size. We check the
overflow here.
* JSTests/stress/fast-stringifier-check-string-length.js: Added.
* Source/JavaScriptCore/runtime/JSONObject.cpp:
(JSC::bufferMode>::append):
Originally-landed-as: 289651.250@safari-7621-branch (fce7b0571506).
rdar://151707436
Canonical link: https://commits.webkit.org/295894@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
