JavaScriptCore-903.tar.gz

[apple/javascriptcore.git] / wtf / text / CString.cpp

diff --git a/wtf/text/CString.cpp b/wtf/text/CString.cpp
index 7d09f1221e25e9aef55d6496fcef203062b7697b..981d77a1db2e456faad927efe29a0641015fad37 100644 (file)
--- a/wtf/text/CString.cpp
+++ b/wtf/text/CString.cpp
@@ -1,5 +1,5 @@
 /*
 /*

- * Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.

  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions


@@ -27,25 +27,34 @@
 #include "config.h"
 #include "CString.h"
 
 #include "config.h"
 #include "CString.h"
 

-using std::min;
+using namespace std;

 
 namespace WTF {
 
 CString::CString(const char* str)
 {
 
 namespace WTF {
 
 CString::CString(const char* str)
 {

+    if (!str)
+        return;
+

     init(str, strlen(str));
 }
 
     init(str, strlen(str));
 }
 

-CString::CString(const char* str, unsigned length)
+CString::CString(const char* str, size_t length)

 {
     init(str, length);
 }
 
 {
     init(str, length);
 }
 

-void CString::init(const char* str, unsigned length)
+void CString::init(const char* str, size_t length)

 {
     if (!str)
         return;
 {
     if (!str)
         return;

-    
+
+    // We need to be sure we can add 1 to length without overflowing.
+    // Since the passed-in length is the length of an actual existing
+    // string, and we know the string doesn't occupy the entire address
+    // space, we can assert here and there's no need for a runtime check.
+    ASSERT(length < numeric_limits<size_t>::max());
+

     m_buffer = CStringBuffer::create(length + 1);
     memcpy(m_buffer->mutableData(), str, length); 
     m_buffer->mutableData()[length] = '\0';
     m_buffer = CStringBuffer::create(length + 1);
     memcpy(m_buffer->mutableData(), str, length); 
     m_buffer->mutableData()[length] = '\0';


@@ -61,6 +70,9 @@ char* CString::mutableData()
     
 CString CString::newUninitialized(size_t length, char*& characterBuffer)
 {
     
 CString CString::newUninitialized(size_t length, char*& characterBuffer)
 {

+    if (length >= numeric_limits<size_t>::max())
+        CRASH();
+

     CString result;
     result.m_buffer = CStringBuffer::create(length + 1);
     char* bytes = result.m_buffer->mutableData();
     CString result;
     result.m_buffer = CStringBuffer::create(length + 1);
     char* bytes = result.m_buffer->mutableData();


@@ -73,11 +85,11 @@ void CString::copyBufferIfNeeded()
 {
     if (!m_buffer || m_buffer->hasOneRef())
         return;
 {
     if (!m_buffer || m_buffer->hasOneRef())
         return;

-        
-    int len = m_buffer->length();
-    RefPtr<CStringBuffer> m_temp = m_buffer;
-    m_buffer = CStringBuffer::create(len);
-    memcpy(m_buffer->mutableData(), m_temp->data(), len);
+
+    RefPtr<CStringBuffer> buffer = m_buffer.release();
+    size_t length = buffer->length();
+    m_buffer = CStringBuffer::create(length);
+    memcpy(m_buffer->mutableData(), buffer->data(), length);

 }
 
 bool operator==(const CString& a, const CString& b)
 }
 
 bool operator==(const CString& a, const CString& b)