Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ef325e63cb21634b26ba345fb7783f4938db6173
https://github.com/WebKit/WebKit/commit/ef325e63cb21634b26ba345fb7783f4938db6173
Author: Chris Dumez <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M Source/WebCore/platform/graphics/MIMESniffer.cpp
M Tools/TestWebKitAPI/Tests/WebCore/MIMESniffer.cpp
Log Message:
-----------
Out-of-bounds read in WebM MIME sniffer at the 0x42 0x82 DocType check
https://bugs.webkit.org/show_bug.cgi?id=320634
Reviewed by Youenn Fablet.
314498@main guarded the inner skip-NUL loop in hasSignatureForWebM(),
but a second unguarded iter + 1 read remains at the top of the loop:
```
while (iter < length && iter < 38) {
if (sequence[iter] == 0x42 && sequence[iter + 1] == 0x82) {
```
The loop guard only guarantees iter < length, not iter + 1 < length. When
iter == length - 1 and sequence[iter] == 0x42, the short-circuit && goes on
to evaluate sequence[iter + 1], reading one byte past the end of the span.
This is reachable before the skip-NUL path 314498@main fixed: a 5-byte
input of EBML magic + a trailing 0x42 (0x1A 0x45 0xDF 0xA3 0x42) enters the
loop at iter == 4 == length - 1 and reads sequence[5]. getMIMETypeFromContent()
is called on attacker-controlled response bytes via MediaResourceSniffer with
a span sized to the exact number of received bytes, so this is a remotely
reachable crash. WebKit builds with hardened libc++, so std::span's bounds
check turns it into a safe abort on every build.
Guard the two-byte compare with iter + 1 < length so the bounds check
short-circuits the dereference, matching the guarded reads later in the
function, and extend the regression test with the truncated 5-byte input.
Test: MIMESniffer.WebMSnifferDoesNotReadPastEnd
* Source/WebCore/platform/graphics/MIMESniffer.cpp:
(WebCore::MIMESniffer::hasSignatureForWebM):
* Tools/TestWebKitAPI/Tests/WebCore/MIMESniffer.cpp:
(TestWebKitAPI::TEST(MIMESniffer, WebMSnifferDoesNotReadPastEnd)):
Canonical link: https://commits.webkit.org/318243@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
