Skip to content

Commit 78b0e30

Browse files
indutnyJulien Gilli
authored and
Julien Gilli
committed
deps: fix out-of-band write in utf8 decoder
Originally reported by: Kris Reeves <[email protected]> Reviewed-By: Trevor Norris <[email protected]>
1 parent c3e02ae commit 78b0e30

File tree

3 files changed

+13
-6
lines changed

3 files changed

+13
-6
lines changed

deps/v8/src/unicode-inl.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ unsigned Utf8::Length(uchar c, int previous) {
155155

156156
Utf8DecoderBase::Utf8DecoderBase()
157157
: unbuffered_start_(NULL),
158+
unbuffered_length_(0),
158159
utf16_length_(0),
159160
last_byte_of_buffer_unused_(false) {}
160161

@@ -194,8 +195,7 @@ unsigned Utf8Decoder<kBufferSize>::WriteUtf16(uint16_t* data,
194195
if (length <= buffer_length) return length;
195196
DCHECK(unbuffered_start_ != NULL);
196197
// Copy the rest the slow way.
197-
WriteUtf16Slow(unbuffered_start_,
198-
data + buffer_length,
198+
WriteUtf16Slow(unbuffered_start_, unbuffered_length_, data + buffer_length,
199199
length - buffer_length);
200200
return length;
201201
}

deps/v8/src/unicode.cc

+8-1
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,7 @@ void Utf8DecoderBase::Reset(uint16_t* buffer,
265265
// Assume everything will fit in the buffer and stream won't be needed.
266266
last_byte_of_buffer_unused_ = false;
267267
unbuffered_start_ = NULL;
268+
unbuffered_length_ = 0;
268269
bool writing_to_buffer = true;
269270
// Loop until stream is read, writing to buffer as long as buffer has space.
270271
unsigned utf16_length = 0;
@@ -291,6 +292,7 @@ void Utf8DecoderBase::Reset(uint16_t* buffer,
291292
// Just wrote last character of buffer
292293
writing_to_buffer = false;
293294
unbuffered_start_ = stream;
295+
unbuffered_length_ = stream_length;
294296
}
295297
continue;
296298
}
@@ -300,20 +302,24 @@ void Utf8DecoderBase::Reset(uint16_t* buffer,
300302
writing_to_buffer = false;
301303
last_byte_of_buffer_unused_ = true;
302304
unbuffered_start_ = stream - cursor;
305+
unbuffered_length_ = stream_length + cursor;
303306
}
304307
utf16_length_ = utf16_length;
305308
}
306309

307310

308311
void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream,
312+
unsigned stream_length,
309313
uint16_t* data,
310314
unsigned data_length) {
311315
while (data_length != 0) {
312316
unsigned cursor = 0;
313-
uint32_t character = Utf8::ValueOf(stream, Utf8::kMaxEncodedSize, &cursor);
317+
318+
uint32_t character = Utf8::ValueOf(stream, stream_length, &cursor);
314319
// There's a total lack of bounds checking for stream
315320
// as it was already done in Reset.
316321
stream += cursor;
322+
stream_length -= cursor;
317323
if (character > unibrow::Utf16::kMaxNonSurrogateCharCode) {
318324
*data++ = Utf16::LeadSurrogate(character);
319325
*data++ = Utf16::TrailSurrogate(character);
@@ -324,6 +330,7 @@ void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream,
324330
data_length -= 1;
325331
}
326332
}
333+
DCHECK(stream_length >= 0);
327334
}
328335

329336

deps/v8/src/unicode.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -172,10 +172,10 @@ class Utf8DecoderBase {
172172
unsigned buffer_length,
173173
const uint8_t* stream,
174174
unsigned stream_length);
175-
static void WriteUtf16Slow(const uint8_t* stream,
176-
uint16_t* data,
177-
unsigned length);
175+
static void WriteUtf16Slow(const uint8_t* stream, unsigned stream_length,
176+
uint16_t* data, unsigned length);
178177
const uint8_t* unbuffered_start_;
178+
unsigned unbuffered_length_;
179179
unsigned utf16_length_;
180180
bool last_byte_of_buffer_unused_;
181181
private:

0 commit comments

Comments
 (0)