Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: 6a4096601203745e85efe54f25d6bfc7d9008f35
https://github.com/WebKit/WebKit/commit/6a4096601203745e85efe54f25d6bfc7d9008f35
Author: Zak Ridouh <[email protected]>
Date: 2026-01-12 (Mon, 12 Jan 2026)
Changed paths:
M Source/WebCore/Modules/encryptedmedia/InitDataRegistry.cpp
M Source/WebCore/xml/XSLTProcessorLibxslt.cpp
M Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp
Log Message:
-----------
Cherry-pick 305255@main (66bfd48c94bf).
https://bugs.webkit.org/show_bug.cgi?id=304140
[WebContent] Fix Integer Underflow in xmlReadMemory
https://bugs.webkit.org/show_bug.cgi?id=304140
rdar://161583041
Reviewed by Brandon Stewart and Ryosuke Niwa.
Fix some potential int underflows before passing the values to `libxml2`
by adding explicit bounds checks using INT_MAX in three locations:
- `XSLTProcessorLibxslt.cpp`: XSLT document loading
- `XMLDocumentParserLibxml2.cpp`: XML document parsing
- `InitDataRegistry.cpp`: PlayReady initialization data parsing (GStreamer)
* Source/WebCore/Modules/encryptedmedia/InitDataRegistry.cpp:
(WebCore::isPlayReadySanitizedInitializationData):
* Source/WebCore/xml/XSLTProcessorLibxslt.cpp:
(WebCore::docLoaderFunc):
* Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::xmlDocPtrForString):
Canonical link: https://commits.webkit.org/305255@main
Canonical link: https://commits.webkit.org/298234.378@webkitglib/2.50
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
