nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1592325 - Fix an unsigned-integer underflow in HashTable.h that's super-easy to trigger using affirmatively wrapping operations. r=froydnj

Browse source 
Differential Revision: https://phabricator.services.mozilla.com/D50960

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Jeff Walden 2019-10-29 16:42:15 +00:00
parent 1ed947aff2
commit 7d74f15a31
1 changed files with 2 additions and 1 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

3
mfbt/HashTable.h
View file

@ -90,6 +90,7 @@
#include "mozilla/ReentrancyGuard.h" #include "mozilla/ReentrancyGuard.h"
#include "mozilla/TypeTraits.h" #include "mozilla/TypeTraits.h"
#include "mozilla/UniquePtr.h" #include "mozilla/UniquePtr.h"
#include "mozilla/WrappingOperations.h"
namespace mozilla { namespace mozilla {
@ -1700,7 +1701,7 @@ class HashTable : private AllocPolicy {
static HashNumber applyDoubleHash(HashNumber aHash1, static HashNumber applyDoubleHash(HashNumber aHash1,
const DoubleHash& aDoubleHash) { const DoubleHash& aDoubleHash) {
return (aHash1 - aDoubleHash.mHash2) & aDoubleHash.mSizeMask; return WrappingSubtract(aHash1, aDoubleHash.mHash2) & aDoubleHash.mSizeMask;
} }
static MOZ_ALWAYS_INLINE bool match(T& aEntry, const Lookup& aLookup) { static MOZ_ALWAYS_INLINE bool match(T& aEntry, const Lookup& aLookup) {