Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4f6534779648190628bb5f642a9d3100c49f3557
https://github.com/WebKit/WebKit/commit/4f6534779648190628bb5f642a9d3100c49f3557
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-11 (Fri, 11 Sep 2026)
Changed paths:
M Source/WebCore/platform/network/BlobResourceHandle.cpp
M Source/WebCore/platform/network/BlobResourceHandleBase.cpp
M Source/WebCore/platform/network/BlobResourceHandleBase.h
Log Message:
-----------
BlobResourceHandle truncates read length through int for file-backed blob
ranges over 2 GB
https://bugs.webkit.org/show_bug.cgi?id=323970
rdar://187207663
Reviewed by Alex Christensen.
BlobResourceHandleBase::readFileAsync() clamped the number of bytes to
read to the total remaining size with `bytesToRead =
static_cast<int>(m_totalRemainingSize)`,
narrowing a uint64_t through a 32-bit signed int. For a file-backed blob
range of 2 GB or more, m_totalRemainingSize exceeds INT_MAX, so the cast
wraps to a negative int and sign-extends back into the uint64_t, corrupting
the length handed to AsyncFileStream::openForRead(). FileStream then
computes a non-positive remaining count and reads nothing, producing a
truncated or empty response body.
The sync sibling BlobResourceHandle::readFileSync() and the in-memory
data path BlobResourceHandleBase::readDataAsync() clamped correctly in
full 64-bit precision, so only the async file path was affected.
Fix the clamp and route all three sites through a single
BlobResourceHandleBase::clampReadSizeToRemaining() helper that uses
std::min<uint64_t>, so the invariant is defined in one place and cannot
be re-narrowed independently. The helper is a protected static member
declared in the header and defined out of line in the implementation
file to keep <algorithm> out of the header.
* Source/WebCore/platform/network/BlobResourceHandle.cpp:
(WebCore::BlobResourceHandle::readFileSync):
* Source/WebCore/platform/network/BlobResourceHandleBase.cpp:
(WebCore::BlobResourceHandleBase::clampReadSizeToRemaining):
(WebCore::BlobResourceHandleBase::readDataAsync):
(WebCore::BlobResourceHandleBase::readFileAsync):
* Source/WebCore/platform/network/BlobResourceHandleBase.h:
Canonical link: https://commits.webkit.org/320981@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
