Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6452e03b9f07419de9b32da99fb4534fc02a3cd0
https://github.com/WebKit/WebKit/commit/6452e03b9f07419de9b32da99fb4534fc02a3cd0
Author: Yijia Huang <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
M JSTests/wasm/debugger/tests/tests.py
M Source/JavaScriptCore/wasm/debugger/WasmDebugServer.cpp
M Source/JavaScriptCore/wasm/debugger/WasmDebugServerUtilities.cpp
M Source/JavaScriptCore/wasm/debugger/WasmDebugServerUtilities.h
M Source/JavaScriptCore/wasm/debugger/WasmExecutionHandler.cpp
M Source/JavaScriptCore/wasm/debugger/WasmMemoryHandler.cpp
M Source/JavaScriptCore/wasm/debugger/WasmQueryHandler.cpp
Log Message:
-----------
[JSC] Reject malformed packets in the WASM debug server instead of defaulting
them
https://bugs.webkit.org/show_bug.cgi?id=324167
rdar://187394149
Reviewed by Yusuke Suzuki.
parseHex() took a default value and returned it whenever the field was empty
or not valid hex. For address and length fields that default was 0, which is
not a sentinel but a real address: the base of instance 0's linear memory. A
malformed m/M packet therefore read or wrote a live instance at the wrong
address, and a malformed qWasmCallStack or qThreadStopInfo resolved to VM 0,
rather than any of these being reported as bad packets.
Replace it with parseHexStrict(), which returns std::optional, has no default,
and accepts hex digits only - parseInteger() would otherwise take surrounding
whitespace and a leading '+', which is the ack character. Every caller now
replies with an error. The two thread
specifications that are legitimately not hex, Hc-1 and Hc0, are matched before
parsing, so they keep working.
Two bounds problems in the same packet paths:
offset + length was computed in size_t and compared against the module or
memory size. A length near SIZE_MAX wrapped the sum back below the size, so the
check passed and the read ran with the unwrapped length. Both reads and the
write now accumulate into CheckedSize and reject on overflow.
An M packet's payload went to toASCIIHexValue() one nibble at a time, which
asserts on non-hex input, so a non-hex payload reached the assertion rather
than an error reply. The payload is now validated with isASCIIHexDigit() before
anything is decoded or written.
MalformedMemoryPacketTestCase covers all of the above, and follows each
rejected packet with a well-formed one, since a wedged stub answers nothing and
the successful follow-up is what proves the server is still serving.
Tests:
JSTests/wasm/debugger/tests/tests.py: MalformedMemoryPacketTestCase
Canonical link: https://commits.webkit.org/321134@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
