Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: dd06e977ecf0cd2a600d7eade4d50b1a0bfea58d
https://github.com/WebKit/WebKit/commit/dd06e977ecf0cd2a600d7eade4d50b1a0bfea58d
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-13 (Sun, 13 Sep 2026)
Changed paths:
M Source/WebCore/platform/network/BlobResourceHandle.cpp
Log Message:
-----------
BlobResourceHandle::readSync() forwards uninitialized buffer tail when blob
is shorter than the read buffer
https://bugs.webkit.org/show_bug.cgi?id=324049
rdar://187287608
Reviewed by Chris Dumez.
readSync() computes `result` as the number of bytes actually read
(buffer.size() - remaining), but then hands the entire buffer to
didReceiveData() rather than just the bytes it filled. When the blob
yields fewer bytes than the buffer holds (e.g. a file-backed blob whose
backing file shrank after its size was captured), the trailing
uninitialized Vector<uint8_t> bytes are forwarded to the client,
leading to uninitialized heap memory.
The asynchronous path already slices correctly
(BlobResourceHandleBase::readAsync passes m_buffer->subspan(0, bytesRead));
this brings the synchronous path in line by forwarding only the bytes read.
* Source/WebCore/platform/network/BlobResourceHandle.cpp:
(WebCore::BlobResourceHandle::readSync): Pass buffer.first(result) to
didReceiveData() instead of the whole buffer.
Canonical link: https://commits.webkit.org/321020@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
