Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 39dc095e8f0e31f06cee8a5f7af31bdb041dc422
https://github.com/WebKit/WebKit/commit/39dc095e8f0e31f06cee8a5f7af31bdb041dc422
Author: Chris Dumez <[email protected]>
Date: 2026-07-14 (Tue, 14 Jul 2026)
Changed paths:
M Source/WTF/wtf/text/Base64.cpp
M Source/WTF/wtf/text/Base64.h
M Tools/TestWebKitAPI/Tests/WTF/Base64.cpp
Log Message:
-----------
calculateBase64EncodedSize() truncates its input length to unsigned,
undersizing the output buffer for inputs larger than 4 GB
https://bugs.webkit.org/show_bug.cgi?id=319372
Reviewed by Darin Adler.
calculateBase64EncodedSize() took an unsigned inputLength, but its callers
pass a size_t span size (base64EncodeInternal() at Base64.cpp:162 and the
StringTypeAdapter<Base64Specification> constructor at Base64.h:189). On
64-bit, an input span whose size() exceeds 2^32 was silently truncated to
32 bits at the call boundary. A size that is small once truncated (e.g.
2^32 + 100 -> 100) but is actually far above maximumBase64EncoderInputBufferSize
slipped past the "> maximumBase64EncoderInputBufferSize" guard and returned
a tiny non-zero encoded size. The full multi-gigabyte input span was then
handed to simdutf::binary_to_base64(), which writes ~size * 4 / 3 bytes into
the undersized destination buffer, overflowing it.
The decode path already guards this exact case (base64Decode() rejects
input.size() > numeric_limits<unsigned>::max()); the encode path did not.
This is a latent defect rather than a practically reachable one: it requires
a single contiguous input buffer larger than 4 GB, and the String-based
entry points (e.g. btoa) are bounded by String::MaxLength (2^31 - 1).
Fix it by taking a size_t inputLength so the cap check runs on the full
length before any narrowing, matching the decode path. The result still fits
in unsigned because maximumBase64EncoderInputBufferSize is chosen so its
padded encoded size is below 2^32.
Test: Base64.EncodedSizeRejectsInputAboveUnsignedRange
* Source/WTF/wtf/text/Base64.cpp:
(WTF::calculateBase64EncodedSize):
* Source/WTF/wtf/text/Base64.h:
* Tools/TestWebKitAPI/Tests/WTF/Base64.cpp:
(TestWebKitAPI::TEST(Base64, EncodedSizeRejectsInputAboveUnsignedRange)):
Canonical link: https://commits.webkit.org/317218@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
