Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ad8eace7e8e7d59ba0b106f71c388c0c4e602940
https://github.com/WebKit/WebKit/commit/ad8eace7e8e7d59ba0b106f71c388c0c4e602940
Author: Kristian Monsen <[email protected]>
Date: 2026-09-10 (Thu, 10 Sep 2026)
Changed paths:
A LayoutTests/ipc/blob-registry-null-url-crash-expected.txt
A LayoutTests/ipc/blob-registry-null-url-crash.html
M Source/WebCore/platform/network/BlobRegistryImpl.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
[IPC] Blob registry messages carrying a null URL crash the network process
https://bugs.webkit.org/show_bug.cgi?id=323525
rdar://185199578
Reviewed by Sihui Liu.
A null String is HashTraits<String>::emptyValue() — the hash table's
empty-bucket marker — so it can never legally be a key. And the key is hashed
before the table is probed or validated: StringHash::hash and URLHash::hash
both do an unconditional impl()->hash(), which faults at StringImpl + 0x10
(m_hashAndFlags) when the impl is null.
This commit rejects the null URL string before it ever reaches a hash operation:
- BlobRegistryImpl — the lookups (blobDataFromURL, registerBlobURLHandle,
addBlobData, …) return the "no such blob" answer they'd have given for an
unregistered URL, so no caller behaviour changes for valid input.
- NetworkConnectionToWebProcess — the register/unregister messages bail before
touching m_blobURLs / m_blobURLHandles, which are keyed by URL and hash the
same way.
Nothing downstream needs the null case to work: a null URL can never match a
registered blob, so "reject early" and "look it up" have the same result for
every input a well-behaved web process can send.
Test: ipc/blob-registry-null-url-crash.html
* LayoutTests/ipc/blob-registry-null-url-crash-expected.txt: Added.
* LayoutTests/ipc/blob-registry-null-url-crash.html: Added.
* Source/WebCore/platform/network/BlobRegistryImpl.cpp:
(WebCore::isValidBlobURLKey):
(WebCore::BlobRegistryImpl::registerInternalBlobURL):
(WebCore::BlobRegistryImpl::unregisterBlobURL):
(WebCore::BlobRegistryImpl::blobDataFromURL const):
(WebCore::BlobRegistryImpl::addBlobData):
(WebCore::BlobRegistryImpl::registerBlobURLHandle):
(WebCore::BlobRegistryImpl::unregisterBlobURLHandle):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerInternalBlobURL):
(WebKit::NetworkConnectionToWebProcess::registerBlobURL):
(WebKit::NetworkConnectionToWebProcess::registerInternalBlobURLForSlice):
(WebKit::NetworkConnectionToWebProcess::unregisterBlobURL):
(WebKit::NetworkConnectionToWebProcess::registerBlobURLHandle):
(WebKit::NetworkConnectionToWebProcess::unregisterBlobURLHandle):
Canonical link: https://commits.webkit.org/320859@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
