Handle odd data lengths in UTF-16 decoder

Source/wtf/text/TextCodecUTF16.cpp

 /*
  * Copyright (C) 2004, 2006, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 12 matching lines @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "wtf/text/TextCodecUTF16.h"
 
 #include "wtf/PassOwnPtr.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuffer.h"
 #include "wtf/text/WTFString.h"
+#include "wtf/unicode/CharacterNames.h"
 
 using namespace std;
 
 namespace WTF {
 
 void TextCodecUTF16::registerEncodingNames(EncodingNameRegistrar registrar)
 {
     registrar("UTF-16LE", "UTF-16LE");
     registrar("UTF-16BE", "UTF-16BE");
 
@@ skipping 16 matching lines @@
 {
     return adoptPtr(new TextCodecUTF16(false));
 }
 
 void TextCodecUTF16::registerCodecs(TextCodecRegistrar registrar)
 {
     registrar("UTF-16LE", newStreamingTextDecoderUTF16LE, 0);
     registrar("UTF-16BE", newStreamingTextDecoderUTF16BE, 0);
 }
 
-String TextCodecUTF16::decode(const char* bytes, size_t length, bool, bool, bool&)
+String TextCodecUTF16::decode(const char* bytes, size_t length, bool flush, bool, bool& sawError)
 {
-    if (!length)
-        return String();
+    if (!length) {
+        if (!flush || !m_haveBufferedByte)
+            return String();
+        sawError = true;
+        String s;
+        s.append(Unicode::replacementCharacter);

[abarth-chromium, 2013/09/05 05:57:51]

Never call String::append.  It's a terrible, no good, awful function.  The idiom
you want here is:

return String(&Unicode::replacementCharacter, 1);

+        return s;
+    }
 
     // FIXME: This should generate an error if there is an unpaired surrogate.
 
     const unsigned char* p = reinterpret_cast<const unsigned char*>(bytes);
     size_t numBytes = length + m_haveBufferedByte;
-    size_t numChars = numBytes / 2;
+    size_t numCharsIn = numBytes / 2;
+    size_t numCharsOut = ((numBytes & 1) && flush) ? numCharsIn + 1 : numCharsIn;
 
-    StringBuffer<UChar> buffer(numChars);
+    StringBuffer<UChar> buffer(numCharsOut);
     UChar* q = buffer.characters();
 
     if (m_haveBufferedByte) {
         UChar c;
         if (m_littleEndian)
             c = m_bufferedByte | (p[0] << 8);
         else
             c = (m_bufferedByte << 8) | p[0];
         *q++ = c;
         m_haveBufferedByte = false;
         p += 1;
-        numChars -= 1;
+        numCharsIn -= 1;
     }
 
     if (m_littleEndian) {
-        for (size_t i = 0; i < numChars; ++i) {
+        for (size_t i = 0; i < numCharsIn; ++i) {
             UChar c = p[0] | (p[1] << 8);
             p += 2;
             *q++ = c;
         }
     } else {
-        for (size_t i = 0; i < numChars; ++i) {
+        for (size_t i = 0; i < numCharsIn; ++i) {
             UChar c = (p[0] << 8) | p[1];
             p += 2;
             *q++ = c;
         }
     }
 
     if (numBytes & 1) {
         ASSERT(!m_haveBufferedByte);
-        m_haveBufferedByte = true;
-        m_bufferedByte = p[0];
+
+        if (flush) {
+            sawError = true;
+            *q++ = Unicode::replacementCharacter;
+        } else {
+            m_haveBufferedByte = true;
+            m_bufferedByte = p[0];
+        }
     }
 
     buffer.shrink(q - buffer.characters());
 
     return String::adopt(buffer);
 }
 
 CString TextCodecUTF16::encode(const UChar* characters, size_t length, UnencodableHandling)
 {
     // We need to be sure we can double the length without overflowing.
@@ skipping 43 matching lines @@
         for (size_t i = 0; i < length; ++i) {
             bytes[i * 2] = 0;
             bytes[i * 2 + 1] = characters[i];
         }
     }
 
     return result;
 }
 
 } // namespace WTF