Skip to content

GitLab

T
tangled
Commit d79413b3 authored by Hayato Ito's avatar Hayato Ito Committed by Commit Bot
Browse files
Options

Fix a crash in loading an empty resource in a bundle 

A crash occurs when loading an empty resource in a bundle because
PipeDataSource::Read accesses data_[offset] even when data_.size() is
zero.

We should memcpy only when |len| > 0 to avoid out-of-range access.

Bug: 1082020
Change-Id: I4c04ef38029c30ef57908ddaf8c4868e66531c5b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2463095Reviewed-by: default avatarKunihiko Sakamoto <ksakamoto@chromium.org>
Reviewed-by: default avatarKinuko Yasuda <kinuko@chromium.org>
Commit-Queue: Hayato Ito <hayato@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816456}
parent 02caa3cd
Hide whitespace changes
Inline Side-by-side
Showing with 29 additions and 1 deletion
third_party/blink/renderer/platform/loader/fetch/url_loader/web_bundle_subresource_loader.cc
View file @ d79413b3
...@@ -106,7 +106,10 @@ class PipeDataSource : public mojo::DataPipeProducer::DataSource { ...@@ -106,7 +106,10 @@ class PipeDataSource : public mojo::DataPipeProducer::DataSource {
} }
size_t offset = base::checked_cast<size_t>(uint64_offset); size_t offset = base::checked_cast<size_t>(uint64_offset);
size_t len = std::min(data_.size() - offset, buffer.size()); size_t len = std::min(data_.size() - offset, buffer.size());
memcpy(buffer.data(), &data_[offset], len); if (len > 0) {
DCHECK_LT(offset, data_.size());
memcpy(buffer.data(), &data_[offset], len);
}
result.bytes_read = len; result.bytes_read = len;
return result; return result;
} }
......
third_party/blink/web_tests/http/tests/loading/wbn/resources/generate-test-wbns.sh
View file @ d79413b3
...@@ -32,3 +32,10 @@ gen-bundle \ ...@@ -32,3 +32,10 @@ gen-bundle \
-primaryURL https://localhost:8443/loading/wbn/resources/wbn/server/wbn-subresource-third-party-origin-trial/script.js \ -primaryURL https://localhost:8443/loading/wbn/resources/wbn/server/wbn-subresource-third-party-origin-trial/script.js \
-dir wbn-subresource-third-party-origin-trial/ \ -dir wbn-subresource-third-party-origin-trial/ \
-o wbn/wbn-subresource-third-party-origin-trial.wbn -o wbn/wbn-subresource-third-party-origin-trial.wbn
gen-bundle \
-version b1 \
-baseURL http://127.0.0.1:8000/loading/wbn/resources/wbn/ \
-primaryURL http://127.0.0.1:8000/loading/wbn/resources/wbn/empty.js \
-dir empty-resource/ \
-o wbn/empty-resource.wbn
third_party/blink/web_tests/http/tests/loading/wbn/subresource-loading/subresource-loading-empty-resource-crash.html 0 → 100644
View file @ d79413b3
<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<body>
<link
rel="webbundle"
href="../resources/wbn/empty-resource.wbn"
resources="http://127.0.0.1:8000/loading/wbn/resources/wbn/empty.js"
/>
<script>
promise_test(async () => {
const response = await fetch(
"http://127.0.0.1:8000/loading/wbn/resources/wbn/empty.js"
);
assert_true(response.ok);
}, "Loading an empty resource in a bundle should not cause a crash");
</script>
</body>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment