Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d364bb4bc4594419e663a242a4d577c4a406a57e
https://github.com/WebKit/WebKit/commit/d364bb4bc4594419e663a242a4d577c4a406a57e
Author: Kristian Monsen <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A
LayoutTests/ipc/register-url-schemes-as-cors-enabled-null-scheme-crash-expected.txt
A
LayoutTests/ipc/register-url-schemes-as-cors-enabled-null-scheme-crash.html
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/NetworkSchemeRegistry.cpp
M Source/WebKit/NetworkProcess/NetworkSchemeRegistry.h
Log Message:
-----------
Null scheme in RegisterURLSchemesAsCORSEnabled IPC crashes the Networking
process
https://bugs.webkit.org/show_bug.cgi?id=323930
rdar://185195800
Reviewed by Chris Dumez.
NetworkSchemeRegistry::registerURLSchemeAsCORSEnabled added a scheme decoded
straight off the wire into a HashSet<String, ASCIICaseInsensitiveHash> without
checking for a null String, which ArgumentCoder<String>::decode happily
produces from the 0xFFFFFFFF length sentinel. Hashing the key dereferenced a
null StringImpl, faulting on m_hashAndFlags at offset 0x10.
A null String cannot live in this container: ASCIICaseInsensitiveHash does not
support null strings, and the null String is the table's empty value. No
legitimate WebProcess sends one. The only feeder is
WebProcessPool::registerURLSchemeAsCORSEnabled, which would trip over its own
HashSet<String> before the message was sent, and the reconnect path in
WebProcess resends a set LegacySchemeRegistry has already filtered. Reject it
with MESSAGE_CHECK.
Take the IPC::Connection in registerURLSchemeAsCORSEnabled so the check lives
with the container holding the invariant rather than in the message handler,
following NetworkBroadcastChannelRegistry. The registry is created per
NetworkConnectionToWebProcess, so the connection to terminate is unambiguous.
Also null-check the StringView in shouldTreatURLSchemeAsCORSEnabled to match
LegacySchemeRegistry. Behavior-preserving; both callers pass URL::protocol().
Test: ipc/register-url-schemes-as-cors-enabled-null-scheme-crash.html
*
LayoutTests/ipc/register-url-schemes-as-cors-enabled-null-scheme-crash-expected.txt:
Added.
* LayoutTests/ipc/register-url-schemes-as-cors-enabled-null-scheme-crash.html:
Added.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerURLSchemesAsCORSEnabled):
* Source/WebKit/NetworkProcess/NetworkSchemeRegistry.cpp:
(WebKit::NetworkSchemeRegistry::registerURLSchemeAsCORSEnabled):
(WebKit::NetworkSchemeRegistry::shouldTreatURLSchemeAsCORSEnabled):
* Source/WebKit/NetworkProcess/NetworkSchemeRegistry.h:
Canonical link: https://commits.webkit.org/321122@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
