Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 560f0ec3582807f0a2867481e85a2cf112972eba
https://github.com/WebKit/WebKit/commit/560f0ec3582807f0a2867481e85a2cf112972eba
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-12 (Sat, 12 Sep 2026)
Changed paths:
M Source/WebCore/platform/network/cf/CertificateInfoCFNet.cpp
Log Message:
-----------
CertificateInfo::containsNonRootSHA1SignedCertificate() bounds the
certificate chain loop with a count from a separate SecTrust call
https://bugs.webkit.org/show_bug.cgi?id=324031
rdar://187261119
Reviewed by Chris Dumez.
containsNonRootSHA1SignedCertificate() indexed the certificate array
returned by SecTrustCopyCertificateChain() using a count obtained from a
separate SecTrustGetCertificateCount() call. Since the count and the
array came from two independent Security-framework calls, a mismatch
could index out of bounds. The result of SecTrustCopyCertificateChain()
was also never null-checked, and trust().get() was re-evaluated on every
loop iteration.
Derive the loop bound from CFArrayGetCount() on the same array being
indexed, null-check the copied chain, and evaluate the trust once.
* Source/WebCore/platform/network/cf/CertificateInfoCFNet.cpp:
(WebCore::CertificateInfo::containsNonRootSHA1SignedCertificate const):
Canonical link: https://commits.webkit.org/321001@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
