[Webkit-unassigned] [Bug 166622] New: [EFL] fix buffer over-read in RenderThemeEfl::mediaControlsStyleSheet()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=166622

            Bug ID: 166622
           Summary: [EFL] fix buffer over-read in
                    RenderThemeEfl::mediaControlsStyleSheet()
    Classification: Unclassified
           Product: WebKit
           Version: Other
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit EFL
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: olivier.blin at softathome.com
                CC: benjamin at webkit.org, darin at apple.com,
                    gyuyoung.kim at webkit.org, lucas.de.marchi at gmail.com,
                    magomez at igalia.com, mcatanzaro at igalia.com,
                    zan at falconsigh.net

This has been detected by a charactersAreAllASCII() assert failure.
Initially in WebKitForWayland (WPE), but the code was likely borrowed from EFL.

This is because ASCIILiteral() is wrongly used in mediaControlsStyleSheet().
mediaControlsBaseUserAgentStyleSheet is a char array, not a null-terminated string.
It is thus incorrect to use StringImpl::createFromLiteral() that calls strlen() to get the string length.

The String::ConstructFromLiteral constructor can not be used, since it skips the last character.

The size should be explicitly passed to the String constructor.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161230/f24e737f/attachment.html>