Commit 05ba3352 authored by jgruber's avatar jgruber Committed by Commit bot

Revert of Fix an OOB read through CallSite.GetFunctionName (patchset #1 id:1...

Revert of Fix an OOB read through CallSite.GetFunctionName (patchset #1 id:1 of https://codereview.chromium.org/2199333002/ )

Reason for revert:
We can revert this now that it's landed on 5.3.

Original issue's description:
> Fix an OOB read through CallSite.GetFunctionName
>
> The func_index parameter passed to GetWasmFunctionNameFromTable can be
> user-controlled through the CallSite constructor. Catch out-of-bounds
> reads and return null as the function name in such cases.
>
> This applies to the 5.3 branch and will be reverted on TOT in a bit.
>
> BUG=632965
>
> Committed: https://crrev.com/8592c450a68581d7257c1b2002983c0092cd749a
> Cr-Commit-Position: refs/heads/master@{#38276}

TBR=ahaas@chromium.org,yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=632965

Review-Url: https://codereview.chromium.org/2225773002
Cr-Commit-Position: refs/heads/master@{#38414}
parent 13eae124
......@@ -54,7 +54,7 @@ MaybeHandle<String> GetWasmFunctionNameFromTable(
uint32_t num_funcs = static_cast<uint32_t>(func_names_array->get_int(0));
DCHECK(static_cast<int>(num_funcs) >= 0);
Factory* factory = func_names_array->GetIsolate()->factory();
if (func_index >= num_funcs) return {};
DCHECK(func_index < num_funcs);
int offset = func_names_array->get_int(func_index + 1);
if (offset < 0) return {};
int next_offset = func_index == num_funcs - 1
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment