Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c4b0cc5dfbdbd0868b7d2a07ed2b1bc24b6d085a
https://github.com/WebKit/WebKit/commit/c4b0cc5dfbdbd0868b7d2a07ed2b1bc24b6d085a
Author: Kristian Monsen <[email protected]>
Date: 2026-09-25 (Fri, 25 Sep 2026)
Changed paths:
A
LayoutTests/ipc/webrtc-create-resolver-null-address-message-check-expected.txt
A LayoutTests/ipc/webrtc-create-resolver-null-address-message-check.html
M Source/WebKit/NetworkProcess/webrtc/NetworkRTCProvider.cpp
Log Message:
-----------
NetworkMDNSRegister::hasRegisteredName() null-derefs when
NetworkRTCProvider::CreateResolver is sent a null address
https://bugs.webkit.org/show_bug.cgi?id=324114
rdar://187001692
Reviewed by Chris Dumez.
StringHash::hash() is key.impl()->hash() with no null check, and
HashTable::checkKey cannot catch it because
StringHash::safeToCompareToEmptyOrDeleted is false, so any HashSet<String>
lookup with a null key faults before the
empty-bucket comparison. A null address is a legal IPC payload that no well
behaved WebContent process sends, so
reject it with a MESSAGE_CHECK at the entry point.
The check has to be the first thing createResolver() does, before the hop to
the main run loop: NetworkRTCProvider
registers with addMessageReceiver(dispatcher, receiver, ...), so its messages
are dispatched on the RTC network
thread, and since 321450@main a message check marks the dispatch scope on the
thread that is dispatching the
message. Once createResolver() has hopped, there is no scope left to mark.
Test: ipc/webrtc-create-resolver-null-address-message-check.html
*
LayoutTests/ipc/webrtc-create-resolver-null-address-message-check-expected.txt:
Added.
* LayoutTests/ipc/webrtc-create-resolver-null-address-message-check.html: Added.
* Source/WebKit/NetworkProcess/webrtc/NetworkRTCProvider.cpp:
(WebKit::NetworkRTCProvider::createResolver):
Canonical link: https://commits.webkit.org/321886@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
