2009-04-19 Sam Weinig <sam@webkit.org>

        Reviewed by Dan Bernstein.

        Fix for <rdar://problem/5860954>
        Harden JSStringCreateWithCFString against malformed CFStringRefs.

        * API/JSStringRefCF.cpp:
        (JSStringCreateWithCFString):



git-svn-id: svn://svn.chromium.org/blink/trunk@42659 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/JavaScriptCore/API/JSStringRefCF.cpp

@@ -38,6 +38,8 @@ JSStringRef JSStringCreateWithCFString(CFStringRef string)
 {
     JSC::initializeThreading();
     CFIndex length = CFStringGetLength(string);
+    if (length < 0)
+        CRASH():
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());

third_party/WebKit/JavaScriptCore/ChangeLog

+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5860954>
+        Harden JSStringCreateWithCFString against malformed CFStringRefs.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
 2009-04-19  David Kilzer  <ddkilzer@apple.com>
 
         Make FEATURE_DEFINES completely dynamic