Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f1fe25b43b64a779250e57669cab8d4cf4c78278
https://github.com/WebKit/WebKit/commit/f1fe25b43b64a779250e57669cab8d4cf4c78278
Author: Chris Dumez <[email protected]>
Date: 2026-07-27 (Mon, 27 Jul 2026)
Changed paths:
A
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https-expected.txt
A
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https.html
M Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp
Log Message:
-----------
Null std::optional dereference in CtapAuthenticator when a full key store is
reported without authenticatorSelection
https://bugs.webkit.org/show_bug.cgi?id=320342
rdar://problem/183363933
Reviewed by Pascoe.
CtapAuthenticator::continueMakeCredentialAfterResponseReceived() dereferenced
options.authenticatorSelection with operator-> when handling a
CTAP2_ERR_KEYSTORE_FULL response, without first checking that the optional was
engaged. authenticatorSelection is a spec-optional dictionary
(std::optional<AuthenticatorSelectionCriteria>) that is empty whenever a page
calls navigator.credentials.create() without it, and every other access in this
file guards it with `options.authenticatorSelection &&`. As a result, a page
that
omits authenticatorSelection and talks to an authenticator whose key store is
full would crash the UI process (a libc++ hardening assertion under the bounds-/
value-checked optional).
Guard the access with the boolean form of the optional, matching the sibling
check in continueMakeCredentialAfterCheckExcludedCredentials(). When
authenticatorSelection is absent the code now falls through to the default
"resident key not required" path, marks the key store full, retries the request
once, and eventually times out instead of crashing.
Test:
http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https.html
*
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https-expected.txt:
Added.
*
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https.html:
Added.
* Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:
(WebKit::CtapAuthenticator::continueMakeCredentialAfterResponseReceived):
Canonical link: https://commits.webkit.org/318018@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
