Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 05:11:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1592325 - Fix an unsigned-integer underflow in HashTable.h that's super-easy to trigger using affirmatively wrapping operations. r=froydnj

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D50960

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Jeff Walden 2019-10-29 16:42:15 +00:00
parent 1ed947aff2
commit 7d74f15a31
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
mfbt/HashTable.h
View File

@ -90,6 +90,7 @@
#include "mozilla/ReentrancyGuard.h"
#include "mozilla/TypeTraits.h"
#include "mozilla/UniquePtr.h"
#include "mozilla/WrappingOperations.h"
namespace mozilla {
@ -1700,7 +1701,7 @@ class HashTable : private AllocPolicy {
static HashNumber applyDoubleHash(HashNumber aHash1,
const DoubleHash& aDoubleHash) {
return (aHash1 - aDoubleHash.mHash2) & aDoubleHash.mSizeMask;
return WrappingSubtract(aHash1, aDoubleHash.mHash2) & aDoubleHash.mSizeMask;
}
static MOZ_ALWAYS_INLINE bool match(T& aEntry, const Lookup& aLookup) {