Potential overflow in RenderLayer::hitTestList()
authorcdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Apr 2016 19:57:10 +0000 (19:57 +0000)
committercdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Apr 2016 19:57:10 +0000 (19:57 +0000)
https://bugs.webkit.org/show_bug.cgi?id=156804

Reviewed by Simon Fraser.

Use size_t type instead of int to iterate over the Vector to make sure
we don't overflow. This is a speculative fix for <rdar://problem/23249479>.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::hitTestList):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@199781 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderLayer.cpp

index b9f702c..9e36fce 100644 (file)
@@ -1,3 +1,16 @@
+2016-04-20  Chris Dumez  <cdumez@apple.com>
+
+        Potential overflow in RenderLayer::hitTestList()
+        https://bugs.webkit.org/show_bug.cgi?id=156804
+
+        Reviewed by Simon Fraser.
+
+        Use size_t type instead of int to iterate over the Vector to make sure
+        we don't overflow. This is a speculative fix for <rdar://problem/23249479>.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestList):
+
 2016-04-20  Brady Eidson  <beidson@apple.com>
 
         Modern IDB (Workers): Enable INDEXED_DATABASE_IN_WORKERS compile time flag, but disabled in RuntimeEnabledFeatures.
index a252040..872cb89 100644 (file)
@@ -5352,8 +5352,8 @@ RenderLayer* RenderLayer::hitTestList(Vector<RenderLayer*>* list, RenderLayer* r
         return nullptr;
 
     RenderLayer* resultLayer = nullptr;
-    for (int i = list->size() - 1; i >= 0; --i) {
-        RenderLayer* childLayer = list->at(i);
+    for (size_t i = list->size(); i > 0; --i) {
+        RenderLayer* childLayer = list->at(i - 1);
         if (childLayer->isFlowThreadCollectingGraphicsLayersUnderRegions())
             continue;
         RenderLayer* hitLayer = nullptr;