Changeset 249087 in webkit

Timestamp:

Aug 24, 2019, 9:02:52 AM (7 years ago)

Author:

Chris Dumez

Message:

Make CacheStorageEngineCaches's decodeCachesNames() more robust against bad input data
​https://bugs.webkit.org/show_bug.cgi?id=201102

Reviewed by Antti Koivisto.

Use Vector::tryReserveCapacity() instead of Vector::reserveInitialCapacity() in CacheStorage::decodeCachesNames()
since the size is read from disk and thus cannot be trusted. If the size is too large, reserveInitialCapacity()
would end up crashing the network process. Now, we merely discard the data if tryReserveCapacity() fails because
the size is too large.

• NetworkProcess/cache/CacheStorageEngineCaches.cpp:

(WebKit::CacheStorage::decodeCachesNames):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/cache/CacheStorageEngineCaches.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-08-24  Chris Dumez  <cdumez@apple.com>
+
+        Make CacheStorageEngineCaches's decodeCachesNames() more robust against bad input data
+        https://bugs.webkit.org/show_bug.cgi?id=201102
+
+        Reviewed by Antti Koivisto.
+
+        Use Vector::tryReserveCapacity() instead of Vector::reserveInitialCapacity() in CacheStorage::decodeCachesNames()
+        since the size is read from disk and thus cannot be trusted. If the size is too large, reserveInitialCapacity()
+        would end up crashing the network process. Now, we merely discard the data if tryReserveCapacity() fails because
+        the size is too large.
+
+        * NetworkProcess/cache/CacheStorageEngineCaches.cpp:
+        (WebKit::CacheStorage::decodeCachesNames):
+
 2019-08-23  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebKit/NetworkProcess/cache/CacheStorageEngineCaches.cpp

@@ -412 +412 @@
 
     Vector<std::pair<String, String>> names;
-    names.reserveInitialCapacity(count);
+    if (!names.tryReserveCapacity(count))
+        return makeUnexpected(Error::ReadDisk);
+
     for (size_t index = 0; index < count; ++index) {
         String name;