Add CharacterData.deleteData()/replaceData() overflow handling.

Source/core/dom/CharacterData.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 14 matching lines @@
 #include "bindings/v8/ExceptionState.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/MutationObserverInterestGroup.h"
 #include "core/dom/MutationRecord.h"
 #include "core/dom/ProcessingInstruction.h"
 #include "core/dom/Text.h"
 #include "core/editing/FrameSelection.h"
 #include "core/events/MutationEvent.h"
 #include "core/inspector/InspectorInstrumentation.h"
-
-using namespace std;
+#include "wtf/CheckedArithmetic.h"
 
 namespace WebCore {
 
 void CharacterData::atomize()
 {
     m_data = AtomicString(m_data);
 }
 
 void CharacterData::setData(const String& data)
 {
@@ skipping 51 matching lines @@
     }
 
     String newStr = m_data;
     newStr.insert(data, offset);
 
     setDataAndUpdate(newStr, offset, 0, data.length(), recalcStyleBehavior);
 
     document().didInsertText(this, offset, data.length());
 }
 
+static bool validateOffsetCount(unsigned offset, unsigned count, unsigned length, unsigned& realCount, ExceptionState& exceptionState)
+{
+    if (offset > length) {
+        exceptionState.throwDOMException(IndexSizeError, "The offset " + String::number(offset) + " is greater than the node's length (" + String::number(length) + ").");
+        return false;
+    }
+
+    Checked<unsigned, RecordOverflow> offsetCount = offset;
+    offsetCount += count;
+
+    if (offsetCount.hasOverflowed() || offset + count > length)
+        realCount = length - offset;
+    else
+        realCount = count;
+
+    return true;
+}
+
 void CharacterData::deleteData(unsigned offset, unsigned count, ExceptionState& exceptionState, RecalcStyleBehavior recalcStyleBehavior)
 {
-    if (offset > length()) {
-        exceptionState.throwDOMException(IndexSizeError, "The offset " + String::number(offset) + " is greater than the node's length (" + String::number(length()) + ").");
+    unsigned realCount;
+    if (!validateOffsetCount(offset, count, length(), realCount, exceptionState))
         return;
-    }
-
-    unsigned realCount;
-    if (offset + count > length())
-        realCount = length() - offset;
-    else
-        realCount = count;
 
     String newStr = m_data;
     newStr.remove(offset, realCount);
 
-    setDataAndUpdate(newStr, offset, count, 0, recalcStyleBehavior);
+    setDataAndUpdate(newStr, offset, realCount, 0, recalcStyleBehavior);
 
     document().didRemoveText(this, offset, realCount);
 }
 
 void CharacterData::replaceData(unsigned offset, unsigned count, const String& data, ExceptionState& exceptionState)
 {
-    if (offset > length()) {
-        exceptionState.throwDOMException(IndexSizeError, "The offset " + String::number(offset) + " is greater than the node's length (" + String::number(length()) + ").");
+    unsigned realCount;
+    if (!validateOffsetCount(offset, count, length(), realCount, exceptionState))
         return;
-    }
-
-    unsigned realCount;
-    if (offset + count > length())
-        realCount = length() - offset;
-    else
-        realCount = count;
 
     String newStr = m_data;
     newStr.remove(offset, realCount);

[tapted, 2014/04/10 03:16:18]

[sheriff] hi there! gcc is generating a warning here: CharacterData.cpp:146:36:
error: 'realCount' may be used uninitialized in this function
[-Werror=maybe-uninitialized]
chromeos-chrome-36.0.1933.0_alpha-r1:      newStr.remove(offset, realCount);

It's coming up in the chrome tree, so I think we need to revert that blink roll.

[sof, 2014/04/10 06:58:54]

Thanks (what gcc version?)

https://codereview.chromium.org/232603002/ to address. Or if it results in fewer
bumps to revert this CL & combine the two, that can alternatively be done.

     newStr.insert(data, offset);
 
-    setDataAndUpdate(newStr, offset, count, data.length());
+    setDataAndUpdate(newStr, offset, realCount, data.length());
 
     // update the markers for spell checking and grammar checking
     document().didRemoveText(this, offset, realCount);
     document().didInsertText(this, offset, data.length());
 }
 
 String CharacterData::nodeValue() const
 {
     return m_data;
 }
@@ skipping 47 matching lines @@
 {
     return static_cast<int>(length());
 }
 
 bool CharacterData::offsetInCharacters() const
 {
     return true;
 }
 
 } // namespace WebCore