Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 94ff9f23ee9c041c4bb9b657469a327ebb79ae12
https://github.com/WebKit/WebKit/commit/94ff9f23ee9c041c4bb9b657469a327ebb79ae12
Author: Sabith Saheb <[email protected]>
Date: 2026-07-12 (Sun, 12 Jul 2026)
Changed paths:
M Source/WebCore/loader/TextResourceDecoder.cpp
Log Message:
-----------
Off-by-one out-of-bounds read in KanjiCode::judge()
https://bugs.webkit.org/show_bug.cgi?id=318680
Reviewed by Chris Dumez.
KanjiCode::judge() scans response bytes to guess a Japanese encoding
during charset autodetection. Two branches guard the string[i + 1]
lookahead with (string.size() - i >= 1), which is always true inside the
while (i < string.size()) loop, so when the final byte (i == size - 1)
falls in 0x81..0x9f or 0xfd..0xfe the code reads string[i + 1], one past
the end of the span. string is a std::span and WebKit builds with
hardened libc++, so this is caught as a safe release-assert crash, not a
heap-buffer-overflow or a security bug. The sibling hiragana/katakana
branches already use the correct (string.size() - i > 1) guard; this
makes the two SJIS/EUC lead-byte branches match. Inputs that actually
have a following byte take the same branch as before.
* Source/WebCore/loader/TextResourceDecoder.cpp:
(KanjiCode::judge):
Canonical link: https://commits.webkit.org/317011@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
