Title: [280838] releases/WebKitGTK/webkit-2.32/Source/WebKit
- Revision
- 280838
- Author
- [email protected]
- Date
- 2021-08-10 02:33:28 -0700 (Tue, 10 Aug 2021)
Log Message
Merge r274160 - [IPC Hardening] IPC::decode(Decoder& decoder, RetainPtr<CFDictionaryRef>&) should make sure keys & values aren't null
https://bugs.webkit.org/show_bug.cgi?id=222980
Reviewed by Geoffrey Garen.
[NSMutableDictionary setObject:forKey:] throws an exception when the given object or key is nil. The dictionary decoder
should therefore fail nicely when either of these is nil, instead of crashing.
* Shared/cf/ArgumentCodersCF.cpp:
(IPC::decode):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog (280837 => 280838)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:31:51 UTC (rev 280837)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:33:28 UTC (rev 280838)
@@ -1,5 +1,18 @@
2021-03-09 Chris Dumez <[email protected]>
+ [IPC Hardening] IPC::decode(Decoder& decoder, RetainPtr<CFDictionaryRef>&) should make sure keys & values aren't null
+ https://bugs.webkit.org/show_bug.cgi?id=222980
+
+ Reviewed by Geoffrey Garen.
+
+ [NSMutableDictionary setObject:forKey:] throws an exception when the given object or key is nil. The dictionary decoder
+ should therefore fail nicely when either of these is nil, instead of crashing.
+
+ * Shared/cf/ArgumentCodersCF.cpp:
+ (IPC::decode):
+
+2021-03-09 Chris Dumez <[email protected]>
+
[IPC Hardening] SandboxExtension::HandleArray IPC decoder should not call Vector::resize()
https://bugs.webkit.org/show_bug.cgi?id=222977
<rdar://problem/75218451>
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/cf/ArgumentCodersCF.cpp (280837 => 280838)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/cf/ArgumentCodersCF.cpp 2021-08-10 09:31:51 UTC (rev 280837)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/cf/ArgumentCodersCF.cpp 2021-08-10 09:33:28 UTC (rev 280838)
@@ -458,11 +458,11 @@
RetainPtr<CFMutableDictionaryRef> dictionary = adoptCF(CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
for (uint64_t i = 0; i < size; ++i) {
RetainPtr<CFTypeRef> key;
- if (!decode(decoder, key))
+ if (!decode(decoder, key) || !key)
return false;
RetainPtr<CFTypeRef> value;
- if (!decode(decoder, value))
+ if (!decode(decoder, value) || !value)
return false;
CFDictionarySetValue(dictionary.get(), key.get(), value.get());
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
