Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9eb4e2ad5983af0d494b62b38e55ff9010fb5993
https://github.com/WebKit/WebKit/commit/9eb4e2ad5983af0d494b62b38e55ff9010fb5993
Author: Claudio Saavedra <[email protected]>
Date: 2026-10-04 (Sun, 04 Oct 2026)
Changed paths:
M Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_OAEPOpenSSL.cpp
M Source/WebCore/crypto/openssl/CryptoKeyRSAOpenSSL.cpp
M Source/WebCore/crypto/openssl/OpenSSLUtilities.cpp
Log Message:
-----------
[OpenSSL] Fix -Wunsafe-buffer-usage violations in crypto/openssl
https://bugs.webkit.org/show_bug.cgi?id=326062
Reviewed by Adrian Perez de Castro and Patrick Griffis.
None of the ports that build the OpenSSL WebCrypto backend enable
-Wunsafe-buffer-usage, so three violations have gone unnoticed. They become
errors as soon as the backend is built on a port that does and treats
warnings as fatal, which is the case for GTK and WPE (bug 286932).
No new tests, no change in behaviour.
* Source/WebCore/crypto/openssl/CryptoAlgorithmRSA_OAEPOpenSSL.cpp:
(WebCore::CryptoAlgorithmRSA_OAEP::platformEncrypt):
(WebCore::CryptoAlgorithmRSA_OAEP::platformDecrypt): Use unsafeMakeSpan()
for the buffer returned by OPENSSL_malloc().
* Source/WebCore/crypto/openssl/CryptoKeyRSAOpenSSL.cpp:
(WebCore::exponentVectorToUInt32): Iterate over a span of the vector instead
of doing arithmetic on its end iterator.
* Source/WebCore/crypto/openssl/OpenSSLUtilities.cpp:
(WebCore::AESKey::~AESKey): Use secureZeroBytes(). Unlike memset(), it is
not a dead store the compiler may drop, so the key material is actually
cleared.
Canonical link: https://commits.webkit.org/322662@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
