Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5266b49c0b9d09b6770c72a35a513fb014013af7
https://github.com/WebKit/WebKit/commit/5266b49c0b9d09b6770c72a35a513fb014013af7
Author: Chris Dumez <[email protected]>
Date: 2026-06-22 (Mon, 22 Jun 2026)
Changed paths:
M Source/WebKit/Shared/EditingRange.h
M Source/WebKit/Shared/EditingRange.serialization.in
M Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in
M Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm
M Tools/TestWebKitAPI/Tests/IPC/ArgumentCoderTests.cpp
Log Message:
-----------
EditingRange with an overflowing location + length crashes the UIProcess on
IPC decode
https://bugs.webkit.org/show_bug.cgi?id=317557
rdar://179393966
Reviewed by Abrar Rahman Protyasha and Darin Adler.
WebPage::firstRectForCharacterRangeAsync() computed the "actual range" it sends
back to the UIProcess using unchecked 64-bit arithmetic. When
the requested range
had a location near UINT64_MAX, location + length wrapped, and the resulting
EditingRange had a location + length that overflowed. On the UIProcess side, the
generated EditingRange decoder validated the range with Checked<uint64_t>, whose
default OverflowHandler is CrashOnOverflow, so decoding the reply deliberately
crashed the UIProcess instead of rejecting the message.
Fix both sides:
- The decode validator now uses CheckedUint64 (RecordOverflow), so an
overflowing
range fails to decode gracefully rather than crashing the receiving process.
- firstRectForCharacterRangeAsync() now clamps the first-line range with
saturating
arithmetic (EditingRange::clampedFirstLineRange), so the WebProcess never
produces
an overflowing range in the first place.
ShareableResourceHandle had the same latent bug (Checked<unsigned> in its m_size
validator); fix it the same way and mark the type [WebKitPlatform] so its
generated
coder is reachable from the API
tests.
Test: Tools/TestWebKitAPI/Tests/IPC/ArgumentCoderTests.cpp
* Source/WebKit/Shared/EditingRange.cpp:
(WebKit::EditingRange::clampedFirstLineRange):
* Source/WebKit/Shared/EditingRange.h:
* Source/WebKit/Shared/EditingRange.serialization.in:
* Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in:
* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:
(WebKit::WebPage::firstRectForCharacterRangeAsync):
* Tools/TestWebKitAPI/Tests/IPC/ArgumentCoderTests.cpp:
(TestWebKitAPI::TEST(ArgumentCoderEditingRange,
OverflowingRangeIsRejectedNotCrashed)):
(TestWebKitAPI::TEST(EditingRangeFirstLineClamp,
NeverProducesOverflowingRange)):
(TestWebKitAPI::TEST(ArgumentCoderShareableResourceHandle,
OverflowingOffsetAndSizeIsRejectedNotCrashed)):
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dj5M8F2Fv2&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE1NjU3QG1haW4=&emid=7aa3240e-9804-47a4-9890-c0d2a87d9ca1&c=11
To unsubscribe from these emails, change
your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
