Changeset 274160 in webkit

Timestamp:

Mar 9, 2021, 10:58:53 AM (5 years ago)

Author:

Chris Dumez

Message:

[IPC Hardening] IPC::decode(Decoder& decoder, RetainPtr<CFDictionaryRef>&) should make sure keys & values aren't null
​https://bugs.webkit.org/show_bug.cgi?id=222980

Reviewed by Geoffrey Garen.

[NSMutableDictionary setObject:forKey:] throws an exception when the given object or key is nil. The dictionary decoder
should therefore fail nicely when either of these is nil, instead of crashing.

• Shared/cf/ArgumentCodersCF.cpp:

(IPC::decode):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/cf/ArgumentCodersCF.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-09  Chris Dumez  <cdumez@apple.com>
+
+        [IPC Hardening] IPC::decode(Decoder& decoder, RetainPtr<CFDictionaryRef>&) should make sure keys & values aren't null
+        https://bugs.webkit.org/show_bug.cgi?id=222980
+
+        Reviewed by Geoffrey Garen.
+
+        [NSMutableDictionary setObject:forKey:] throws an exception when the given object or key is nil. The dictionary decoder
+        should therefore fail nicely when either of these is nil, instead of crashing.
+
+        * Shared/cf/ArgumentCodersCF.cpp:
+        (IPC::decode):
+
 2021-03-09  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/Shared/cf/ArgumentCodersCF.cpp

@@ -459 +459 @@
     for (uint64_t i = 0; i < size; ++i) {
         RetainPtr<CFTypeRef> key;
-        if (!decode(decoder, key))
+        if (!decode(decoder, key) || !key)
             return false;
 
         RetainPtr<CFTypeRef> value;
-        if (!decode(decoder, value))
+        if (!decode(decoder, value) || !value)
             return false;