Changeset 280837 in webkit

Timestamp:

Aug 10, 2021, 2:31:51 AM (5 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r274158 - [IPC Hardening] SandboxExtension::HandleArray IPC decoder should not call Vector::resize()
​https://bugs.webkit.org/show_bug.cgi?id=222977
<rdar://problem/75218451>

Reviewed by Anders Carlsson.

SandboxExtension::HandleArray IPC decoder should not call Vector::resize() with an untrusted size
coming from IPC. Instead, call Vector::append(), like the Vector IPC decoder does.

• Shared/Cocoa/SandboxExtensionCocoa.mm:

(WebKit::SandboxExtension::HandleArray::append):
(WebKit::SandboxExtension::HandleArray::decode):

• Shared/SandboxExtension.h:

(WebKit::SandboxExtension::append):

Location:

releases/WebKitGTK/webkit-2.32/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/Cocoa/SandboxExtensionCocoa.mm (modified) (3 diffs)
• Shared/SandboxExtension.h (modified) (2 diffs)

releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-09  Chris Dumez  <cdumez@apple.com>
+
+        [IPC Hardening] SandboxExtension::HandleArray IPC decoder should not call Vector::resize()
+        https://bugs.webkit.org/show_bug.cgi?id=222977
+        <rdar://problem/75218451>
+
+        Reviewed by Anders Carlsson.
+
+        SandboxExtension::HandleArray IPC decoder should not call Vector::resize() with an untrusted size
+        coming from IPC. Instead, call Vector::append(), like the Vector IPC decoder does.
+
+        * Shared/Cocoa/SandboxExtensionCocoa.mm:
+        (WebKit::SandboxExtension::HandleArray::append):
+        (WebKit::SandboxExtension::HandleArray::decode):
+        * Shared/SandboxExtension.h:
+        (WebKit::SandboxExtension::append):
+
 2021-03-09  Chris Dumez  <cdumez@apple.com>
 

releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm

@@ -188 +188 @@
 }
 
+void SandboxExtension::HandleArray::append(Handle&& handle)
+{
+    m_data.append(WTFMove(handle));
+}
+
 SandboxExtension::Handle& SandboxExtension::HandleArray::operator[](size_t i)
 {
@@ -218 +223 @@
     if (!size)
         return WTF::nullopt;
+
     SandboxExtension::HandleArray handles;
-    handles.allocate(*size);
     for (size_t i = 0; i < *size; ++i) {
         Optional<SandboxExtension::Handle> handle;
@@ -225 +230 @@
         if (!handle)
             return WTF::nullopt;
-        handles[i] = WTFMove(*handle);
+        handles.append(WTFMove(*handle));
     }
     return WTFMove(handles);

releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/SandboxExtension.h

@@ -91 +91 @@
         ~HandleArray();
         void allocate(size_t);
+        void append(Handle&&);
         Handle& operator[](size_t i);
         Handle& at(size_t i) { return operator[](i); }
@@ -150 +151 @@
 inline SandboxExtension::HandleArray::~HandleArray() { }
 inline void SandboxExtension::HandleArray::allocate(size_t) { }
+inline void SandboxExtension::HandleArray::append(Handle&&) { }
 inline size_t SandboxExtension::HandleArray::size() const { return 0; }    
 inline const SandboxExtension::Handle& SandboxExtension::HandleArray::operator[](size_t) const { return m_emptyHandle; }