Title: [249087] trunk/Source/WebKit
- Revision
- 249087
- Author
- [email protected]
- Date
- 2019-08-24 09:02:52 -0700 (Sat, 24 Aug 2019)
Log Message
Make CacheStorageEngineCaches's decodeCachesNames() more robust against bad input data
https://bugs.webkit.org/show_bug.cgi?id=201102
Reviewed by Antti Koivisto.
Use Vector::tryReserveCapacity() instead of Vector::reserveInitialCapacity() in CacheStorage::decodeCachesNames()
since the size is read from disk and thus cannot be trusted. If the size is too large, reserveInitialCapacity()
would end up crashing the network process. Now, we merely discard the data if tryReserveCapacity() fails because
the size is too large.
* NetworkProcess/cache/CacheStorageEngineCaches.cpp:
(WebKit::CacheStorage::decodeCachesNames):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (249086 => 249087)
--- trunk/Source/WebKit/ChangeLog 2019-08-24 13:36:29 UTC (rev 249086)
+++ trunk/Source/WebKit/ChangeLog 2019-08-24 16:02:52 UTC (rev 249087)
@@ -1,3 +1,18 @@
+2019-08-24 Chris Dumez <[email protected]>
+
+ Make CacheStorageEngineCaches's decodeCachesNames() more robust against bad input data
+ https://bugs.webkit.org/show_bug.cgi?id=201102
+
+ Reviewed by Antti Koivisto.
+
+ Use Vector::tryReserveCapacity() instead of Vector::reserveInitialCapacity() in CacheStorage::decodeCachesNames()
+ since the size is read from disk and thus cannot be trusted. If the size is too large, reserveInitialCapacity()
+ would end up crashing the network process. Now, we merely discard the data if tryReserveCapacity() fails because
+ the size is too large.
+
+ * NetworkProcess/cache/CacheStorageEngineCaches.cpp:
+ (WebKit::CacheStorage::decodeCachesNames):
+
2019-08-23 Wenson Hsieh <[email protected]>
[iOS] [WebKit2] Tapping on the “I’m” text suggestion after typing “i’” does nothing
Modified: trunk/Source/WebKit/NetworkProcess/cache/CacheStorageEngineCaches.cpp (249086 => 249087)
--- trunk/Source/WebKit/NetworkProcess/cache/CacheStorageEngineCaches.cpp 2019-08-24 13:36:29 UTC (rev 249086)
+++ trunk/Source/WebKit/NetworkProcess/cache/CacheStorageEngineCaches.cpp 2019-08-24 16:02:52 UTC (rev 249087)
@@ -411,7 +411,9 @@
return makeUnexpected(Error::ReadDisk);
Vector<std::pair<String, String>> names;
- names.reserveInitialCapacity(count);
+ if (!names.tryReserveCapacity(count))
+ return makeUnexpected(Error::ReadDisk);
+
for (size_t index = 0; index < count; ++index) {
String name;
if (!decoder.decode(name))
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
