Changeset 259789 in webkit

Timestamp:

Apr 9, 2020, 4:01:58 AM (6 years ago)

Author:

ddkilzer@apple.com

Message:

UserData::decode should add bounds checks
<​https://webkit.org/b/210247>
<rdar://problem/61467748>

Reviewed by Alex Christensen.

• Shared/UserData.cpp:

(WebKit::UserData::decode):

• Add bounds checks using WTF::isInBounds<size_t>.
• Shared/UserData.h:

(WebKit::UserData::decode):

• Add WARN_UNUSED_RETURN.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/UserData.cpp (modified) (3 diffs)
• Shared/UserData.h (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        UserData::decode should add bounds checks
+        <https://webkit.org/b/210247>
+        <rdar://problem/61467748>
+
+        Reviewed by Alex Christensen.
+
+        * Shared/UserData.cpp:
+        (WebKit::UserData::decode):
+        - Add bounds checks using WTF::isInBounds<size_t>.
+        * Shared/UserData.h:
+        (WebKit::UserData::decode):
+        - Add WARN_UNUSED_RETURN.
+
 2020-04-09  David Kilzer  <ddkilzer@apple.com>
 

trunk/Source/WebKit/Shared/UserData.cpp

@@ -50 +50 @@
 #include "WebRenderLayer.h"
 #include "WebRenderObject.h"
+#include <wtf/CheckedArithmetic.h>
 
 #if PLATFORM(COCOA)
@@ -341 +342 @@
     switch (type) {
     case API::Object::Type::Array: {
-        uint64_t size;
-        if (!decoder.decode(size))
-            return false;
+        uint64_t decodedSize;
+        if (!decoder.decode(decodedSize))
+            return false;
+
+        if (!WTF::isInBounds<size_t>(decodedSize))
+            return false;
+
+        auto size = static_cast<size_t>(decodedSize);
 
         Vector<RefPtr<API::Object>> elements;
@@ -377 +383 @@
 
     case API::Object::Type::Dictionary: {
-        uint64_t size;
-        if (!decoder.decode(size))
-            return false;
+        uint64_t decodedSize;
+        if (!decoder.decode(decodedSize))
+            return false;
+
+        if (!WTF::isInBounds<size_t>(decodedSize))
+            return false;
+
+        auto size = static_cast<size_t>(decodedSize);
 
         API::Dictionary::MapType map;

trunk/Source/WebKit/Shared/UserData.h

@@ -53 +53 @@
 
     void encode(IPC::Encoder&) const;
-    static bool decode(IPC::Decoder&, UserData&);
+    static bool decode(IPC::Decoder&, UserData&) WARN_UNUSED_RETURN;
 
     static void encode(IPC::Encoder&, const API::Object*);
-    static bool decode(IPC::Decoder&, RefPtr<API::Object>&);
+    static bool decode(IPC::Decoder&, RefPtr<API::Object>&) WARN_UNUSED_RETURN;
 
 private: