Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e08a16763c94edc94dbd8bf2a7d498f3451e5d9f
https://github.com/WebKit/WebKit/commit/e08a16763c94edc94dbd8bf2a7d498f3451e5d9f
Author: SABITHSAHEB <[email protected]>
Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths:
M Source/WTF/wtf/URLHelpers.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKPage/glib/TestWebKitURIUtilities.cpp
Log Message:
-----------
Fix out-of-bounds buffer index in userVisibleURL when probing for xn--
https://bugs.webkit.org/show_bug.cgi?id=319161
Reviewed by Patrick Griffis.
userVisibleURL() probes the output buffer for an "xn--" prefix by reading
back from the index it just wrote (after[afterIndex - 4 .. afterIndex - 2]),
but it gated those reads on the input index (i >= 3) rather than the output
index. When an earlier percent escape decodes to a single byte (for example
%AB, which is > 0x7f), the input index advances three positions while the
output index advances one, so a '-' can be reached while afterIndex < 4.
afterIndex - 4 then wraps around as size_t and indexes the bounds-checked
Vector out of range.
Gate the probe on afterIndex >= 4 so it tracks the buffer it actually reads.
A legitimate "xn--" prefix always writes four literal output bytes, so its
detection is unaffected. The input is reachable from untrusted data through
the public webkit_uri_for_display() API and Internals.userVisibleString; the
minimal trigger is "%AB-".
* Source/WTF/wtf/URLHelpers.cpp:
(WTF::URLHelpers::userVisibleURL):
* Tools/TestWebKitAPI/Tests/WebKit/WKPage/glib/TestWebKitURIUtilities.cpp:
(testURIForDisplayShortPercentEncoded):
(beforeAll):
Canonical link: https://commits.webkit.org/317537@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
