Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 25cee58a0e3b7acd0c1fd3271753b193a368fdd7
https://github.com/WebKit/WebKit/commit/25cee58a0e3b7acd0c1fd3271753b193a368fdd7
Author: Chris Dumez <[email protected]>
Date: 2025-01-08 (Wed, 08 Jan 2025)
Changed paths:
A
LayoutTests/http/tests/text/font-preloading-via-header-empty-value-crash-expected.txt
A
LayoutTests/http/tests/text/font-preloading-via-header-empty-value-crash.html
A
LayoutTests/http/tests/text/resources/font-preloading-via-header-empty-value-crash-iframe.py
M Source/WebCore/loader/LinkHeader.cpp
Log Message:
-----------
Regression(288466@main) ASSERT(valueLength > 0) is hit in
parseParameterValue()
https://bugs.webkit.org/show_bug.cgi?id=285640
rdar://142559962
Reviewed by Ryosuke Niwa.
In 288466@main, I updated LinkHeader.cpp's parseParameterValue() to address
unsafe buffer warnings.
One of the changes made was to stop using pointer arithmetics and use an index
in the span instead.
However, I made a mistake and converted this assertion:
```
ASSERT(valueEnd >= valueStart);
```
into
```
ASSERT(valueLength > 0);
```
The equivalent check would have been `valueLength >= 0` but since `valueLength`
is of unsigned
type so it is always true. Therefore, I am dropping the assertion. We already
make sure that
`valueLength` is non-zero whenever we decrement it.
*
LayoutTests/http/tests/text/font-preloading-via-header-empty-value-crash-expected.txt:
Added.
*
LayoutTests/http/tests/text/font-preloading-via-header-empty-value-crash.html:
Added.
*
LayoutTests/http/tests/text/resources/font-preloading-via-header-empty-value-crash-iframe.py:
Added.
* Source/WebCore/loader/LinkHeader.cpp:
(WebCore::parseParameterValue):
Canonical link: https://commits.webkit.org/288635@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
