Skip to content

Commit 8f23ef0

Browse files
David Kilzerddkilzer
David Kilzer
authored and
ddkilzer
committed
REGRESSION (279702@main): Incorrect use of sizeof() in checkJSStringOOBUTF8() from testapi.c
<https://bugs.webkit.org/show_bug.cgi?id=295037> <rdar://154311531> Reviewed by Yusuke Suzuki. Revert 279702@main and add a separate cStringSize variable for testing. * Source/JavaScriptCore/API/tests/testapi.c: (checkJSStringOOBUTF8): (checkJSStringOOBUTF16): (checkJSStringOOBUTF16AtEnd): - Switch back to stack-allocated buffers by reverting 279702@main. - Add IGNORE_WARNINGS_BEGIN("vla")/IGNORE_WARNINGS_END macros to avoid warnings in open source clang for the SaferCPP EWS bot. - Add separate cStringSize variable so outCStringSize matches the size of the buffer. Canonical link: https://commits.webkit.org/296699@main
1 parent eac29b3 commit 8f23ef0

1 file changed

Lines changed: 37 additions & 28 deletions

File tree

‎Source/JavaScriptCore/API/tests/testapi.c‎

Lines changed: 37 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1192,42 +1192,48 @@ void JSSynchronousGarbageCollectForDebugging(JSContextRef);
11921192
static void checkJSStringOOBUTF8(void)
11931193
{
11941194
const size_t sourceCStringSize = 200;
1195-
const size_t outCStringSize = 10;
1195+
const size_t cStringSize = 10;
1196+
const size_t outCStringSize = cStringSize + sourceCStringSize;
11961197

1197-
char* sourceCString = (char*)malloc(sourceCStringSize);
1198-
memset(sourceCString, 0, sourceCStringSize);
1198+
IGNORE_WARNINGS_BEGIN("vla")
1199+
char sourceCString[sourceCStringSize];
1200+
IGNORE_WARNINGS_END
1201+
memset(sourceCString, 0, sizeof(sourceCString));
11991202
for (size_t i = 0; i < sourceCStringSize - 1; ++i)
12001203
sourceCString[i] = '0' + (i%10);
12011204

1202-
char* outCString = (char*)malloc(outCStringSize + sourceCStringSize);
1203-
memset(outCString, 0x13, outCStringSize + sourceCStringSize);
1205+
IGNORE_WARNINGS_BEGIN("vla")
1206+
char outCString[outCStringSize];
1207+
IGNORE_WARNINGS_END
1208+
memset(outCString, 0x13, sizeof(outCString));
12041209

12051210
JSStringRef str = JSStringCreateWithUTF8CString(sourceCString);
1206-
size_t bytesWritten = JSStringGetUTF8CString(str, outCString, outCStringSize);
1211+
size_t bytesWritten = JSStringGetUTF8CString(str, outCString, cStringSize);
12071212

12081213
assertTrue(bytesWritten == 10, "we report 10 bytes written precisely");
12091214

12101215
for (size_t i = 0; i < sizeof(outCString); ++i) {
1211-
if (i == outCStringSize - 1)
1216+
if (i == cStringSize - 1)
12121217
assertTrue(outCString[i] == '\0', "string terminated");
1213-
else if (i < outCStringSize - 1)
1218+
else if (i < cStringSize - 1)
12141219
assertTrue(outCString[i] == sourceCString[i], "string copied");
12151220
else
12161221
assertTrue(outCString[i] == 0x13, "did not write past the end");
12171222
}
12181223

12191224
JSStringRelease(str);
1220-
free(outCString);
1221-
free(sourceCString);
12221225
}
12231226

12241227
static void checkJSStringOOBUTF16(void)
12251228
{
12261229
const size_t sourceCStringSize = 22;
1227-
const size_t outCStringSize = 20;
1230+
const size_t cStringSize = 20;
1231+
const size_t outCStringSize = cStringSize + sourceCStringSize;
12281232

1229-
char* sourceCString = (char*)malloc(sourceCStringSize);
1230-
memset(sourceCString, 0, sourceCStringSize);
1233+
IGNORE_WARNINGS_BEGIN("vla")
1234+
char sourceCString[sourceCStringSize];
1235+
IGNORE_WARNINGS_END
1236+
memset(sourceCString, 0, sizeof(sourceCString));
12311237
for (size_t i = 0; i < sourceCStringSize - 1; ++i)
12321238
sourceCString[i] = '0' + (i%10);
12331239

@@ -1236,35 +1242,38 @@ static void checkJSStringOOBUTF16(void)
12361242
sourceCString[5] = '\x98';
12371243
sourceCString[6] = '\x81';
12381244

1239-
char* outCString = (char*)malloc(outCStringSize + sourceCStringSize);
1240-
memset(outCString, 0x13, outCStringSize + sourceCStringSize);
1245+
IGNORE_WARNINGS_BEGIN("vla")
1246+
char outCString[outCStringSize];
1247+
IGNORE_WARNINGS_END
1248+
memset(outCString, 0x13, sizeof(outCString));
12411249

12421250
JSStringRef str = JSStringCreateWithUTF8CString(sourceCString);
1243-
size_t bytesWritten = JSStringGetUTF8CString(str, outCString, outCStringSize);
1251+
size_t bytesWritten = JSStringGetUTF8CString(str, outCString, cStringSize);
12441252

12451253
assertTrue(bytesWritten == 20, "we report 20 bytes written precisely");
12461254

12471255
for (size_t i = 0; i < sizeof(outCString); ++i) {
1248-
if (i == outCStringSize - 1)
1256+
if (i == cStringSize - 1)
12491257
assertTrue(outCString[i] == '\0', "string terminated");
1250-
else if (i < outCStringSize - 1)
1258+
else if (i < cStringSize - 1)
12511259
assertTrue(outCString[i] == sourceCString[i], "string copied");
12521260
else
12531261
assertTrue(outCString[i] == 0x13, "did not write past the end");
12541262
}
12551263

12561264
JSStringRelease(str);
1257-
free(outCString);
1258-
free(sourceCString);
12591265
}
12601266

12611267
static void checkJSStringOOBUTF16AtEnd(void)
12621268
{
12631269
const size_t sourceCStringSize = 22;
1264-
const size_t outCStringSize = 20;
1270+
const size_t cStringSize = 20;
1271+
const size_t outCStringSize = cStringSize + sourceCStringSize;
12651272

1266-
char* sourceCString = (char*)malloc(sourceCStringSize);
1267-
memset(sourceCString, 0, sourceCStringSize);
1273+
IGNORE_WARNINGS_BEGIN("vla")
1274+
char sourceCString[sourceCStringSize];
1275+
IGNORE_WARNINGS_END
1276+
memset(sourceCString, 0, sizeof(sourceCString));
12681277
for (size_t i = 0; i < sourceCStringSize - 1; ++i)
12691278
sourceCString[i] = '0' + (i%10);
12701279

@@ -1273,11 +1282,13 @@ static void checkJSStringOOBUTF16AtEnd(void)
12731282
sourceCString[19] = '\x98';
12741283
sourceCString[20] = '\x81';
12751284

1276-
char* outCString = (char*)malloc(outCStringSize + sourceCStringSize);
1277-
memset(outCString, 0x13, outCStringSize + sourceCStringSize);
1285+
IGNORE_WARNINGS_BEGIN("vla")
1286+
char outCString[outCStringSize];
1287+
IGNORE_WARNINGS_END
1288+
memset(outCString, 0x13, sizeof(outCString));
12781289

12791290
JSStringRef str = JSStringCreateWithUTF8CString(sourceCString);
1280-
size_t bytesWritten = JSStringGetUTF8CString(str, outCString, outCStringSize);
1291+
size_t bytesWritten = JSStringGetUTF8CString(str, outCString, cStringSize);
12811292

12821293
assertTrue(bytesWritten == 18, "we report 18 bytes written precisely");
12831294

@@ -1291,8 +1302,6 @@ static void checkJSStringOOBUTF16AtEnd(void)
12911302
}
12921303

12931304
JSStringRelease(str);
1294-
free(outCString);
1295-
free(sourceCString);
12961305
}
12971306

12981307
static void checkJSStringOOB(void)

0 commit comments

Comments
 (0)