Commit 1e95840b authored by Wiktor Garbacz's avatar Wiktor Garbacz Committed by Commit Bot

[parser] Proper bounds check and casts for stream creation.

If a negative value is passed as end position it may get past the end
without triggering any DCHECK due to int to size_t cast.

BUG=v8:6093

Change-Id: I0c6be0e8442049cc4b7fc87593ad018bce4b677e
Reviewed-on: https://chromium-review.googlesource.com/494108
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: 's avatarDaniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: 's avatarMarja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45068}
parent c31c9ee0
......@@ -816,16 +816,20 @@ Utf16CharacterStream* ScannerStream::For(Handle<String> data) {
Utf16CharacterStream* ScannerStream::For(Handle<String> data, int start_pos,
int end_pos) {
DCHECK(start_pos >= 0);
DCHECK(start_pos <= end_pos);
DCHECK(end_pos <= data->length());
if (data->IsExternalOneByteString()) {
return new ExternalOneByteStringUtf16CharacterStream(
Handle<ExternalOneByteString>::cast(data), start_pos, end_pos);
Handle<ExternalOneByteString>::cast(data),
static_cast<size_t>(start_pos), static_cast<size_t>(end_pos));
} else if (data->IsExternalTwoByteString()) {
return new ExternalTwoByteStringUtf16CharacterStream(
Handle<ExternalTwoByteString>::cast(data), start_pos, end_pos);
Handle<ExternalTwoByteString>::cast(data),
static_cast<size_t>(start_pos), static_cast<size_t>(end_pos));
} else {
// TODO(vogelheim): Maybe call data.Flatten() first?
return new GenericStringUtf16CharacterStream(data, start_pos, end_pos);
return new GenericStringUtf16CharacterStream(
data, static_cast<size_t>(start_pos), static_cast<size_t>(end_pos));
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment