deps: fix out-of-band write in utf8 decoder
Originally reported by: Kris Reeves <kris.re@bbhmedia.com> Reviewed-By: Trevor Norris <trev.norris@gmail.com>
This commit is contained in:
parent
0f09b8db28
commit
030f8045c7
10
deps/v8/src/unicode-decoder.cc
vendored
10
deps/v8/src/unicode-decoder.cc
vendored
@ -15,6 +15,7 @@ void Utf8DecoderBase::Reset(uint16_t* buffer, size_t buffer_length,
|
|||||||
// Assume everything will fit in the buffer and stream won't be needed.
|
// Assume everything will fit in the buffer and stream won't be needed.
|
||||||
last_byte_of_buffer_unused_ = false;
|
last_byte_of_buffer_unused_ = false;
|
||||||
unbuffered_start_ = NULL;
|
unbuffered_start_ = NULL;
|
||||||
|
unbuffered_length_ = 0;
|
||||||
bool writing_to_buffer = true;
|
bool writing_to_buffer = true;
|
||||||
// Loop until stream is read, writing to buffer as long as buffer has space.
|
// Loop until stream is read, writing to buffer as long as buffer has space.
|
||||||
size_t utf16_length = 0;
|
size_t utf16_length = 0;
|
||||||
@ -41,6 +42,7 @@ void Utf8DecoderBase::Reset(uint16_t* buffer, size_t buffer_length,
|
|||||||
// Just wrote last character of buffer
|
// Just wrote last character of buffer
|
||||||
writing_to_buffer = false;
|
writing_to_buffer = false;
|
||||||
unbuffered_start_ = stream;
|
unbuffered_start_ = stream;
|
||||||
|
unbuffered_length_ = stream_length;
|
||||||
}
|
}
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
@ -50,19 +52,22 @@ void Utf8DecoderBase::Reset(uint16_t* buffer, size_t buffer_length,
|
|||||||
writing_to_buffer = false;
|
writing_to_buffer = false;
|
||||||
last_byte_of_buffer_unused_ = true;
|
last_byte_of_buffer_unused_ = true;
|
||||||
unbuffered_start_ = stream - cursor;
|
unbuffered_start_ = stream - cursor;
|
||||||
|
unbuffered_length_ = stream_length + cursor;
|
||||||
}
|
}
|
||||||
utf16_length_ = utf16_length;
|
utf16_length_ = utf16_length;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream, uint16_t* data,
|
void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream,
|
||||||
|
size_t stream_length, uint16_t* data,
|
||||||
size_t data_length) {
|
size_t data_length) {
|
||||||
while (data_length != 0) {
|
while (data_length != 0) {
|
||||||
size_t cursor = 0;
|
size_t cursor = 0;
|
||||||
uint32_t character = Utf8::ValueOf(stream, Utf8::kMaxEncodedSize, &cursor);
|
uint32_t character = Utf8::ValueOf(stream, stream_length, &cursor);
|
||||||
// There's a total lack of bounds checking for stream
|
// There's a total lack of bounds checking for stream
|
||||||
// as it was already done in Reset.
|
// as it was already done in Reset.
|
||||||
stream += cursor;
|
stream += cursor;
|
||||||
|
stream_length -= cursor;
|
||||||
if (character > unibrow::Utf16::kMaxNonSurrogateCharCode) {
|
if (character > unibrow::Utf16::kMaxNonSurrogateCharCode) {
|
||||||
*data++ = Utf16::LeadSurrogate(character);
|
*data++ = Utf16::LeadSurrogate(character);
|
||||||
*data++ = Utf16::TrailSurrogate(character);
|
*data++ = Utf16::TrailSurrogate(character);
|
||||||
@ -73,6 +78,7 @@ void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream, uint16_t* data,
|
|||||||
data_length -= 1;
|
data_length -= 1;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
DCHECK(stream_length >= 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
} // namespace unibrow
|
} // namespace unibrow
|
||||||
|
8
deps/v8/src/unicode-decoder.h
vendored
8
deps/v8/src/unicode-decoder.h
vendored
@ -23,9 +23,10 @@ class Utf8DecoderBase {
|
|||||||
// The first buffer_length utf16 chars are cached in the buffer.
|
// The first buffer_length utf16 chars are cached in the buffer.
|
||||||
void Reset(uint16_t* buffer, size_t buffer_length, const uint8_t* stream,
|
void Reset(uint16_t* buffer, size_t buffer_length, const uint8_t* stream,
|
||||||
size_t stream_length);
|
size_t stream_length);
|
||||||
static void WriteUtf16Slow(const uint8_t* stream, uint16_t* data,
|
static void WriteUtf16Slow(const uint8_t* stream, size_t stream_length,
|
||||||
size_t length);
|
uint16_t* data, size_t length);
|
||||||
const uint8_t* unbuffered_start_;
|
const uint8_t* unbuffered_start_;
|
||||||
|
size_t unbuffered_length_;
|
||||||
size_t utf16_length_;
|
size_t utf16_length_;
|
||||||
bool last_byte_of_buffer_unused_;
|
bool last_byte_of_buffer_unused_;
|
||||||
|
|
||||||
@ -48,6 +49,7 @@ class Utf8Decoder : public Utf8DecoderBase {
|
|||||||
|
|
||||||
Utf8DecoderBase::Utf8DecoderBase()
|
Utf8DecoderBase::Utf8DecoderBase()
|
||||||
: unbuffered_start_(NULL),
|
: unbuffered_start_(NULL),
|
||||||
|
unbuffered_length_(0),
|
||||||
utf16_length_(0),
|
utf16_length_(0),
|
||||||
last_byte_of_buffer_unused_(false) {}
|
last_byte_of_buffer_unused_(false) {}
|
||||||
|
|
||||||
@ -84,7 +86,7 @@ size_t Utf8Decoder<kBufferSize>::WriteUtf16(uint16_t* data,
|
|||||||
if (length <= buffer_length) return length;
|
if (length <= buffer_length) return length;
|
||||||
DCHECK(unbuffered_start_ != NULL);
|
DCHECK(unbuffered_start_ != NULL);
|
||||||
// Copy the rest the slow way.
|
// Copy the rest the slow way.
|
||||||
WriteUtf16Slow(unbuffered_start_, data + buffer_length,
|
WriteUtf16Slow(unbuffered_start_, unbuffered_length_, data + buffer_length,
|
||||||
length - buffer_length);
|
length - buffer_length);
|
||||||
return length;
|
return length;
|
||||||
}
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user