Changeset 217206 in webkit


Ignore:
Timestamp:
May 21, 2017, 11:57:08 PM (7 years ago)
Author:
Carlos Garcia Campos
Message:

Add more input validation in Connection::readBytesFromSocket()
https://bugs.webkit.org/show_bug.cgi?id=171871

Reviewed by Michael Catanzaro.

Check the control message length is in the limits. Credit to Nathan Crandall for reporting this issue and
submitting an equivalent fix.

  • Platform/IPC/unix/ConnectionUnix.cpp:

(IPC::readBytesFromSocket):

Location:
trunk/Source/WebKit2
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/WebKit2/ChangeLog

    r217189 r217206  
     12017-05-21  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Add more input validation in Connection::readBytesFromSocket()
     4        https://bugs.webkit.org/show_bug.cgi?id=171871
     5
     6        Reviewed by Michael Catanzaro.
     7
     8        Check the control message length is in the limits. Credit to Nathan Crandall for reporting this issue and
     9        submitting an equivalent fix.
     10
     11        * Platform/IPC/unix/ConnectionUnix.cpp:
     12        (IPC::readBytesFromSocket):
     13
    1142017-05-20  Michael Catanzaro  <mcatanzaro@igalia.com>
    215
  • trunk/Source/WebKit2/Platform/IPC/unix/ConnectionUnix.cpp

    r217126 r217206  
    273273        for (controlMessage = CMSG_FIRSTHDR(&message); controlMessage; controlMessage = CMSG_NXTHDR(&message, controlMessage)) {
    274274            if (controlMessage->cmsg_level == SOL_SOCKET && controlMessage->cmsg_type == SCM_RIGHTS) {
     275                if (controlMessage->cmsg_len < CMSG_LEN(0) || controlMessage->cmsg_len > attachmentMaxAmount) {
     276                    ASSERT_NOT_REACHED();
     277                    break;
     278                }
    275279                size_t previousFileDescriptorsSize = fileDescriptors.size();
    276280                size_t fileDescriptorsCount = (controlMessage->cmsg_len - CMSG_LEN(0)) / sizeof(int);
Note: See TracChangeset for help on using the changeset viewer.