Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(7)

Side by Side Diff: src/wasm/wasm-function-name-table.cc

Issue 2199333002: Fix an OOB read through CallSite.GetFunctionName (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2016 the V8 project authors. All rights reserved. 1 // Copyright 2016 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/wasm/wasm-function-name-table.h" 5 #include "src/wasm/wasm-function-name-table.h"
6 6
7 #include "src/wasm/wasm-module.h" 7 #include "src/wasm/wasm-module.h"
8 8
9 namespace v8 { 9 namespace v8 {
10 namespace internal { 10 namespace internal {
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after
47 ++func_index; 47 ++func_index;
48 } 48 }
49 return func_names_array; 49 return func_names_array;
50 } 50 }
51 51
52 MaybeHandle<String> GetWasmFunctionNameFromTable( 52 MaybeHandle<String> GetWasmFunctionNameFromTable(
53 Handle<ByteArray> func_names_array, uint32_t func_index) { 53 Handle<ByteArray> func_names_array, uint32_t func_index) {
54 uint32_t num_funcs = static_cast<uint32_t>(func_names_array->get_int(0)); 54 uint32_t num_funcs = static_cast<uint32_t>(func_names_array->get_int(0));
55 DCHECK(static_cast<int>(num_funcs) >= 0); 55 DCHECK(static_cast<int>(num_funcs) >= 0);
56 Factory* factory = func_names_array->GetIsolate()->factory(); 56 Factory* factory = func_names_array->GetIsolate()->factory();
57 DCHECK(func_index < num_funcs); 57 if (func_index >= num_funcs) return {};
58 int offset = func_names_array->get_int(func_index + 1); 58 int offset = func_names_array->get_int(func_index + 1);
59 if (offset < 0) return {}; 59 if (offset < 0) return {};
60 int next_offset = func_index == num_funcs - 1 60 int next_offset = func_index == num_funcs - 1
61 ? func_names_array->length() 61 ? func_names_array->length()
62 : abs(func_names_array->get_int(func_index + 2)); 62 : abs(func_names_array->get_int(func_index + 2));
63 ScopedVector<byte> buffer(next_offset - offset); 63 ScopedVector<byte> buffer(next_offset - offset);
64 func_names_array->copy_out(offset, buffer.start(), next_offset - offset); 64 func_names_array->copy_out(offset, buffer.start(), next_offset - offset);
65 if (!unibrow::Utf8::Validate(buffer.start(), buffer.length())) return {}; 65 if (!unibrow::Utf8::Validate(buffer.start(), buffer.length())) return {};
66 return factory->NewStringFromUtf8(Vector<const char>::cast(buffer)); 66 return factory->NewStringFromUtf8(Vector<const char>::cast(buffer));
67 } 67 }
68 68
69 } // namespace wasm 69 } // namespace wasm
70 } // namespace internal 70 } // namespace internal
71 } // namespace v8 71 } // namespace v8
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698