Title: [280837] releases/WebKitGTK/webkit-2.32/Source/WebKit
- Revision
- 280837
- Author
- [email protected]
- Date
- 2021-08-10 02:31:51 -0700 (Tue, 10 Aug 2021)
Log Message
Merge r274158 - [IPC Hardening] SandboxExtension::HandleArray IPC decoder should not call Vector::resize()
https://bugs.webkit.org/show_bug.cgi?id=222977
<rdar://problem/75218451>
Reviewed by Anders Carlsson.
SandboxExtension::HandleArray IPC decoder should not call Vector::resize() with an untrusted size
coming from IPC. Instead, call Vector::append(), like the Vector IPC decoder does.
* Shared/Cocoa/SandboxExtensionCocoa.mm:
(WebKit::SandboxExtension::HandleArray::append):
(WebKit::SandboxExtension::HandleArray::decode):
* Shared/SandboxExtension.h:
(WebKit::SandboxExtension::append):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog (280836 => 280837)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:29:58 UTC (rev 280836)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:31:51 UTC (rev 280837)
@@ -1,5 +1,22 @@
2021-03-09 Chris Dumez <[email protected]>
+ [IPC Hardening] SandboxExtension::HandleArray IPC decoder should not call Vector::resize()
+ https://bugs.webkit.org/show_bug.cgi?id=222977
+ <rdar://problem/75218451>
+
+ Reviewed by Anders Carlsson.
+
+ SandboxExtension::HandleArray IPC decoder should not call Vector::resize() with an untrusted size
+ coming from IPC. Instead, call Vector::append(), like the Vector IPC decoder does.
+
+ * Shared/Cocoa/SandboxExtensionCocoa.mm:
+ (WebKit::SandboxExtension::HandleArray::append):
+ (WebKit::SandboxExtension::HandleArray::decode):
+ * Shared/SandboxExtension.h:
+ (WebKit::SandboxExtension::append):
+
+2021-03-09 Chris Dumez <[email protected]>
+
[IPC Hardening] Protect WebPageProxy::willSubmitForm() against bad Strings
https://bugs.webkit.org/show_bug.cgi?id=222955
<rdar://problem/75195062>
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm (280836 => 280837)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm 2021-08-10 09:29:58 UTC (rev 280836)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm 2021-08-10 09:31:51 UTC (rev 280837)
@@ -187,6 +187,11 @@
m_data.resize(size);
}
+void SandboxExtension::HandleArray::append(Handle&& handle)
+{
+ m_data.append(WTFMove(handle));
+}
+
SandboxExtension::Handle& SandboxExtension::HandleArray::operator[](size_t i)
{
RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(i < m_data.size());
@@ -217,14 +222,14 @@
decoder >> size;
if (!size)
return WTF::nullopt;
+
SandboxExtension::HandleArray handles;
- handles.allocate(*size);
for (size_t i = 0; i < *size; ++i) {
Optional<SandboxExtension::Handle> handle;
decoder >> handle;
if (!handle)
return WTF::nullopt;
- handles[i] = WTFMove(*handle);
+ handles.append(WTFMove(*handle));
}
return WTFMove(handles);
}
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/SandboxExtension.h (280836 => 280837)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/SandboxExtension.h 2021-08-10 09:29:58 UTC (rev 280836)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/SandboxExtension.h 2021-08-10 09:31:51 UTC (rev 280837)
@@ -90,6 +90,7 @@
HandleArray& operator=(HandleArray&&) = default;
~HandleArray();
void allocate(size_t);
+ void append(Handle&&);
Handle& operator[](size_t i);
Handle& at(size_t i) { return operator[](i); }
const Handle& operator[](size_t i) const;
@@ -149,6 +150,7 @@
inline SandboxExtension::HandleArray::HandleArray() { }
inline SandboxExtension::HandleArray::~HandleArray() { }
inline void SandboxExtension::HandleArray::allocate(size_t) { }
+inline void SandboxExtension::HandleArray::append(Handle&&) { }
inline size_t SandboxExtension::HandleArray::size() const { return 0; }
inline const SandboxExtension::Handle& SandboxExtension::HandleArray::operator[](size_t) const { return m_emptyHandle; }
inline SandboxExtension::Handle& SandboxExtension::HandleArray::operator[](size_t) { return m_emptyHandle; }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
