Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d58bad697e50a0bda1ff67669bb4cf9e1f78662e
https://github.com/WebKit/WebKit/commit/d58bad697e50a0bda1ff67669bb4cf9e1f78662e
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-04 (Thu, 04 Jun 2026)
Changed paths:
A JSTests/stress/temporal-iso8601-parse-bounds.js
M Source/JavaScriptCore/runtime/ISO8601.cpp
Log Message:
-----------
[JSC] `ISO8601::parseDate` reads past the end of the buffer for short invalid
strings
https://bugs.webkit.org/show_bug.cgi?id=316366
Reviewed by Yusuke Suzuki.
The month/day length guards in parseDate only applied to the Date format, so
short truncated strings like "0", "2024-01-" or "2024-05" reached unchecked
buffer dereferences via PlainYearMonth/PlainMonthDay parsing (and via the
year-less month parsing path for all formats), crashing Release builds with a
span bounds trap. Check the remaining length at every month/day read
regardless of format, and require a day to follow a consumed day separator so
trailing-hyphen strings are rejected instead of read out of bounds.
Test: JSTests/stress/temporal-iso8601-parse-bounds.js
* JSTests/stress/temporal-iso8601-parse-bounds.js: Added.
(shouldBe):
(throw.new.Error):
* Source/JavaScriptCore/runtime/ISO8601.cpp:
(JSC::ISO8601::parseDate):
Canonical link: https://commits.webkit.org/314612@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
