Changeset 275501 in webkit

Timestamp:

Apr 6, 2021 3:01:28 AM (3 years ago)

Author:

rniwa@webkit.org

Message:

IPC::decodeObject null dereference in decodeArrayInternal()
​https://bugs.webkit.org/show_bug.cgi?id=224214

Patch by Ian Gilbert <​iang@apple.com> on 2021-04-06
Reviewed by Ryosuke Niwa.

Add null pointer check to decodeArrayInternal.

Source/WebKit:

Test: ipc/decode-object-array-crash.html

• Shared/Cocoa/ArgumentCodersCocoa.mm:

(IPC::decodeArrayInternal):

LayoutTests:

• ipc/decode-object-array-crash-expected.txt: Added.
• ipc/decode-object-array-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/ipc/decode-object-array-crash-expected.txt (added)
• LayoutTests/ipc/decode-object-array-crash.html (added)
• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/Shared/Cocoa/ArgumentCodersCocoa.mm (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-04-06  Ian Gilbert  <iang@apple.com>
+
+        IPC::decodeObject null dereference in decodeArrayInternal()
+        https://bugs.webkit.org/show_bug.cgi?id=224214
+
+        Reviewed by Ryosuke Niwa.
+
+        Add null pointer check to decodeArrayInternal.
+
+        * ipc/decode-object-array-crash-expected.txt: Added.
+        * ipc/decode-object-array-crash.html: Added.
+
 2021-04-06  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-04-06  Ian Gilbert  <iang@apple.com>
+
+        IPC::decodeObject null dereference in decodeArrayInternal()
+        https://bugs.webkit.org/show_bug.cgi?id=224214
+
+        Reviewed by Ryosuke Niwa.
+
+        Add null pointer check to decodeArrayInternal.
+
+        Test: ipc/decode-object-array-crash.html
+
+        * Shared/Cocoa/ArgumentCodersCocoa.mm:
+        (IPC::decodeArrayInternal):
+
 2021-04-05  Jiewen Tan  <jiewen_tan@apple.com>
 

trunk/Source/WebKit/Shared/Cocoa/ArgumentCodersCocoa.mm

@@ -265 +265 @@
     for (uint64_t i = 0; i < size; ++i) {
         auto value = decodeObject(decoder, allowedClasses);
-        if (!value)
+        if (!value || !value.value())
             return WTF::nullopt;
         [array addObject:value.value().get()];