Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: 420a662a9f52a86949117681d3ce1bd159e98368
https://github.com/WebKit/WebKit/commit/420a662a9f52a86949117681d3ce1bd159e98368
Author: Chris Dumez <[email protected]>
Date: 2026-03-18 (Wed, 18 Mar 2026)
Changed paths:
A
LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group-expected.txt
A LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group.html
M Source/WebCore/Modules/url-pattern/URLPatternComponent.cpp
Log Message:
-----------
Cherry-pick 308534@main (e3f20183b0c4).
https://bugs.webkit.org/show_bug.cgi?id=309048
URLPattern.exec() crashes with nested capturing group
https://bugs.webkit.org/show_bug.cgi?id=309048
rdar://171543463
Reviewed by Youenn Fablet.
The pattern `/:foo((?<x>a))`` produces a part list with a single entry
named `foo`, so `m_groupNameList` has one element. However, the
generated regex wraps the user-provided regex in a capturing group:
`((?<x>a))`, resulting in two capturing groups total. In
`createComponentMatchResult`, the loop iterated based on the regex exec
result length, causing an out-of-bounds access into `m_groupNameList`
when it tried to find a name for the second capturing group.
The fix clamps the loop bound to `m_groupNameList.size() + 1` so only
the top-level capturing groups (one per part) are processed, and any
extra inner capturing groups from user-provided regex patterns are
skipped.
Test: fast/url/url-pattern-exec-with-nested-capturing-group.html
*
LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group-expected.txt:
Added.
* LayoutTests/fast/url/url-pattern-exec-with-nested-capturing-group.html:
Added.
* Source/WebCore/Modules/url-pattern/URLPatternComponent.cpp:
(WebCore::URLPatternUtilities::URLPatternComponent::createComponentMatchResult
const):
Canonical link: https://commits.webkit.org/308534@main
Canonical link: https://commits.webkit.org/298234.510@webkitglib/2.50
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
