Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5d91250a8529e04434ea11a12669ac533bb17e77
https://github.com/WebKit/WebKit/commit/5d91250a8529e04434ea11a12669ac533bb17e77
Author: Chris Dumez <[email protected]>
Date: 2026-07-29 (Wed, 29 Jul 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp
Log Message:
-----------
CacheStorage size accounting can underflow and persist a corrupt size
https://bugs.webkit.org/show_bug.cgi?id=320408
Reviewed by Youenn Fablet.
CacheStorageManager::sizeDecreased() subtracted the given amount from m_size
without checking that it did not exceed the current value. m_size is a uint64_t,
so if the amount ever exceeds the tracked size the subtraction wraps to a value
near UINT64_MAX, which is then written to the cache's size file and used for
quota accounting, effectively corrupting quota reporting for the origin until
the size is re-initialized.
The tracked size is normally kept consistent (increments and decrements are
balanced in putRecordsInStore), but removeRecords() and removeAllRecords() call
sizeDecreased() directly, outside the space-request/initialization path, so the
in-memory accounting and the asynchronously-measured cache size can in theory
drift and the decrement can exceed m_size.
Clamp the subtraction at zero, matching the saturating arithmetic used elsewhere
in this code.
* Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp:
(WebKit::CacheStorageManager::sizeDecreased):
Canonical link: https://commits.webkit.org/318204@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
