2009-04-19 Sam Weinig <sam@webkit.org>

        Reviewed by Darin Adler.

        Better fix for JSStringCreateWithCFString hardening.

        * API/JSStringRefCF.cpp:
        (JSStringCreateWithCFString):



git-svn-id: svn://svn.chromium.org/blink/trunk@42662 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/JavaScriptCore/API/JSStringRefCF.cpp

@@ -37,9 +37,10 @@
 JSStringRef JSStringCreateWithCFString(CFStringRef string)
 {
     JSC::initializeThreading();
-    CFIndex length = CFStringGetLength(string);
-    if (length < 0)
-        CRASH():
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());

third_party/WebKit/JavaScriptCore/ChangeLog

+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Better fix for JSStringCreateWithCFString hardening.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
 2009-04-19  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Dan Bernstein.