[Webkit-unassigned] [Bug 187444] New: PropertyTable::skipDeletedEntries() should guard against iterating past the table end.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=187444

            Bug ID: 187444
           Summary: PropertyTable::skipDeletedEntries() should guard
                    against iterating past the table end.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

PropertyTable supports C++ iteration by offering begin() and end() methods, and an iterator class.  The begin() methods and the iterator operator++() method uses PropertyTable::skipDeletedEntries() to skip over deleted entries in the table.  However, PropertyTable::skipDeletedEntries() does not prevent the iteration pointer from being incremented past the end of the table.  As a result, we can iterate past the end of the table.  Note that the C++ iteration protocol tests for the iterator not being equal to the end() value.  It does not do a <= test.  If the iterator ever shoots past end, the loop will effectively not terminate.

This issue can manifest if and only if the last entry in the table is a deleted one.

<rdar://problem/41282849>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180708/8dc41746/attachment.html>