mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-07-28 11:49:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

AK: Disallow calling ByteString methods that return a view on rvalues

Browse source 
This prevents, for example:

    StringView view = ByteString { "foo" }.view();

This prevents a class of potential UAF.
This commit is contained in:
Timothy Flynn 2024-04-03 22:01:43 -04:00 • committed by Andreas Kling
commit c5c5e52c24
Notes: sideshowbarker 2024-07-17 02:35:27 +09:00
2 changed files with 22 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

8
AK/ByteString.cpp
View file

@ -81,14 +81,14 @@ ByteString ByteString::substring(size_t start) const
return { characters() + start, length() - start };
}
StringView ByteString::substring_view(size_t start, size_t length) const
StringView ByteString::substring_view(size_t start, size_t length) const&
{
VERIFY(!Checked<size_t>::addition_would_overflow(start, length));
VERIFY(start + length <= m_impl->length());
return { characters() + start, length };
}
StringView ByteString::substring_view(size_t start) const
StringView ByteString::substring_view(size_t start) const&
{
VERIFY(start <= length());
return { characters() + start, length() - start };
@ -123,7 +123,7 @@ Vector<ByteString> ByteString::split_limit(char separator, size_t limit, SplitBe
return v;
}
Vector<StringView> ByteString::split_view(Function<bool(char)> separator, SplitBehavior split_behavior) const
Vector<StringView> ByteString::split_view(Function<bool(char)> separator, SplitBehavior split_behavior) const&
{
if (is_empty())
return {};
@ -147,7 +147,7 @@ Vector<StringView> ByteString::split_view(Function<bool(char)> separator, SplitB
return v;
}
Vector<StringView> ByteString::split_view(char const separator, SplitBehavior split_behavior) const
Vector<StringView> ByteString::split_view(char const separator, SplitBehavior split_behavior) const&
{
return split_view([separator](char ch) { return ch == separator; }, split_behavior);
}