Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e3f20183b0c443859c3e27510893a1c4ea617494
https://github.com/WebKit/WebKit/commit/e3f20183b0c443859c3e27510893a1c4ea617494
Author: Chris Dumez <[email protected]>
Date: 2026-03-03 (Tue, 03 Mar 2026)
Changed paths:
A
LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group-expected.txt
A LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group.html
M Source/WebCore/Modules/url-pattern/URLPatternComponent.cpp
Log Message:
-----------
URLPattern.exec() crashes with nested capturing group
https://bugs.webkit.org/show_bug.cgi?id=309048
rdar://171543463
Reviewed by Youenn Fablet.
The pattern `/:foo((?<x>a))`` produces a part list with a single entry
named `foo`, so `m_groupNameList` has one element. However, the
generated regex wraps the user-provided regex in a capturing group:
`((?<x>a))`, resulting in two capturing groups total. In
`createComponentMatchResult`, the loop iterated based on the regex exec
result length, causing an out-of-bounds access into `m_groupNameList`
when it tried to find a name for the second capturing group.
The fix clamps the loop bound to `m_groupNameList.size() + 1` so only
the top-level capturing groups (one per part) are processed, and any
extra inner capturing groups from user-provided regex patterns are
skipped.
Test: fast/url/url-pattern-exec-with-nested-capturing-group.html
*
LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group-expected.txt:
Added.
* LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group.html: Added.
* Source/WebCore/Modules/url-pattern/URLPatternComponent.cpp:
(WebCore::URLPatternUtilities::URLPatternComponent::createComponentMatchResult
const):
Canonical link: https://commits.webkit.org/308534@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
