Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 79d7541f8363bb66866367c2bba1cb1bfd2040aa
https://github.com/WebKit/WebKit/commit/79d7541f8363bb66866367c2bba1cb1bfd2040aa
Author: Pascoe <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
M Tools/TestWebKitAPI/Tests/WebCore/CBORReaderTest.cpp
Log Message:
-----------
Cherry-pick 7fdaeaab71b9. rdar://175673904
[WebCore] cross-container iterator dereference in
AuthenticationExtensionsClientOutputs::fromCBOR
https://bugs.webkit.org/show_bug.cgi?id=313452
rdar://175673904
Reviewed by Aditya Keerthi.
fromCBOR() reuses a single `it` variable across the outer decoded map and
the
credProps sub-map. After reassigning `it` to the result of find("rk") on the
sub-map, the guard compares it against decodedMap.end() — a different
container's
sentinel, so the check always passes. When "rk" is absent, this dereferences
the sub-map's end iterator.
Use a separate credPropsIt variable and compare against credPropsMap.end(),
same
pattern already used for largeBlob below.
Test: Tools/TestWebKitAPI/Tests/WebCore/CBORReaderTest.cpp
* Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientOutputs.cpp:
(WebCore::AuthenticationExtensionsClientOutputs::fromCBOR):
* Tools/TestWebKitAPI/Tests/WebCore/CBORReaderTest.cpp:
(TestWebKitAPI::TEST(CBORReaderTest,
AuthExtensionsFromCBOR_CredPropsWithoutRk)):
Identifier: 305413.800@safari-7624-branch
Originally-landed-as: [email protected] (ce11a67281da).
rdar://185368000
Canonical link: https://commits.webkit.org/320704@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
