Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 66bfd48c94bf04db92322e41ea8b78d64b1c775e
https://github.com/WebKit/WebKit/commit/66bfd48c94bf04db92322e41ea8b78d64b1c775e
Author: Zak Ridouh <[email protected]>
Date: 2026-01-07 (Wed, 07 Jan 2026)
Changed paths:
M Source/WebCore/Modules/encryptedmedia/InitDataRegistry.cpp
M Source/WebCore/xml/XSLTProcessorLibxslt.cpp
M Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp
Log Message:
-----------
[WebContent] Fix Integer Underflow in xmlReadMemory
https://bugs.webkit.org/show_bug.cgi?id=304140
rdar://161583041
Reviewed by Brandon Stewart and Ryosuke Niwa.
Fix some potential int underflows before passing the values to `libxml2`
by adding explicit bounds checks using INT_MAX in three locations:
- `XSLTProcessorLibxslt.cpp`: XSLT document loading
- `XMLDocumentParserLibxml2.cpp`: XML document parsing
- `InitDataRegistry.cpp`: PlayReady initialization data parsing (GStreamer)
* Source/WebCore/Modules/encryptedmedia/InitDataRegistry.cpp:
(WebCore::isPlayReadySanitizedInitializationData):
* Source/WebCore/xml/XSLTProcessorLibxslt.cpp:
(WebCore::docLoaderFunc):
* Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::xmlDocPtrForString):
Canonical link: https://commits.webkit.org/305255@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
