Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape().

Mark Lam · Mark Lam · commit 8dbae6ab3f64 · 2021-07-14T19:15:56.000Z
https://bugs.webkit.org/show_bug.cgi?id=227962 rdar://78392251 Reviewed by Yusuke Suzuki. JSTests: * stress/out-of-memory-in-globalFuncUnescape.js: Added. Source/JavaScriptCore: * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): Canonical link: https://commits.webkit.org/239664@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279915 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
@@ -1,3 +1,13 @@
+2021-07-14  Mark Lam  <mark.lam@apple.com>
+
+        Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape().
+        https://bugs.webkit.org/show_bug.cgi?id=227962
+        rdar://78392251
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/out-of-memory-in-globalFuncUnescape.js: Added.
+
 2021-07-14  Mark Lam  <mark.lam@apple.com>
 
         Placate exception checker validation in operationObjectAssignUntyped.
diff --git a/JSTests/stress/out-of-memory-in-globalFuncUnescape.js b/JSTests/stress/out-of-memory-in-globalFuncUnescape.js
@@ -0,0 +1,11 @@
+//@ if $buildType == "release" && !$memoryLimited then runDefault else skip end
+
+var exception;
+try {
+    unescape('\u0100'.repeat(2**30));
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "RangeError: Out of memory")
+    throw "FAILED";
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,14 @@
+2021-07-14  Mark Lam  <mark.lam@apple.com>
+
+        Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape().
+        https://bugs.webkit.org/show_bug.cgi?id=227962
+        rdar://78392251
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::JSC_DEFINE_HOST_FUNCTION):
+
 2021-07-14  Yusuke Suzuki  <ysuzuki@apple.com>
 
         libpas executable-allocator should reserve more than 256KB for non-fail region at least
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -577,7 +577,7 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncEncodeURIComponent, (JSGlobalObject* globalOb
 
 JSC_DEFINE_HOST_FUNCTION(globalFuncEscape, (JSGlobalObject* globalObject, CallFrame* callFrame))
 {
-    return JSValue::encode(toStringView(globalObject, callFrame->argument(0), [&] (StringView view) {
+    return JSValue::encode(toStringView(globalObject, callFrame->argument(0), [&] (StringView view) -> JSString* {
         static const Bitmap<256> doNotEscape = makeCharacterBitmap(
             "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
             "abcdefghijklmnopqrstuvwxyz"
@@ -586,7 +586,9 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncEscape, (JSGlobalObject* globalObject, CallFr
         );
 
         VM& vm = globalObject->vm();
-        StringBuilder builder;
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        StringBuilder builder(StringBuilder::OverflowHandler::RecordOverflow);
         if (view.is8Bit()) {
             const LChar* c = view.characters8();
             for (unsigned k = 0; k < view.length(); k++, c++) {
@@ -596,33 +598,39 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncEscape, (JSGlobalObject* globalObject, CallFr
                 else
                     builder.append('%', hex(u, 2));
             }
-            return jsString(vm, builder.toString());
+        } else {
+            const UChar* c = view.characters16();
+            for (unsigned k = 0; k < view.length(); k++, c++) {
+                UChar u = c[0];
+                if (u >= doNotEscape.size())
+                    builder.append("%u", hex(static_cast<uint8_t>(u >> 8), 2), hex(static_cast<uint8_t>(u), 2));
+                else if (doNotEscape.get(static_cast<LChar>(u)))
+                    builder.append(*c);
+                else
+                    builder.append('%', hex(u, 2));
+            }
         }
 
-        const UChar* c = view.characters16();
-        for (unsigned k = 0; k < view.length(); k++, c++) {
-            UChar u = c[0];
-            if (u >= doNotEscape.size())
-                builder.append("%u", hex(static_cast<uint8_t>(u >> 8), 2), hex(static_cast<uint8_t>(u), 2));
-            else if (doNotEscape.get(static_cast<LChar>(u)))
-                builder.append(*c);
-            else
-                builder.append('%', hex(u, 2));
+        if (UNLIKELY(builder.hasOverflowed())) {
+            throwOutOfMemoryError(globalObject, scope);
+            return { };
         }
-
         return jsString(vm, builder.toString());
     }));
 }
 
 JSC_DEFINE_HOST_FUNCTION(globalFuncUnescape, (JSGlobalObject* globalObject, CallFrame* callFrame))
 {
-    return JSValue::encode(toStringView(globalObject, callFrame->argument(0), [&] (StringView view) {
+    return JSValue::encode(toStringView(globalObject, callFrame->argument(0), [&] (StringView view) -> JSString* {
         // We use int for k and length intentionally since we would like to evaluate
         // the condition `k <= length -6` even if length is less than 6.
         int k = 0;
         int length = view.length();
 
-        StringBuilder builder;
+        VM& vm = globalObject->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        StringBuilder builder(StringBuilder::OverflowHandler::RecordOverflow);
         builder.reserveCapacity(length);
 
         if (view.is8Bit()) {
@@ -666,7 +674,11 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncUnescape, (JSGlobalObject* globalObject, Call
             }
         }
 
-        return jsString(globalObject->vm(), builder.toString());
+        if (UNLIKELY(builder.hasOverflowed())) {
+            throwOutOfMemoryError(globalObject, scope);
+            return { };
+        }
+        return jsString(vm, builder.toString());
     }));
 }
 
