Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 57fe702497349c44e516699e352e1fa3ea146036
https://github.com/WebKit/WebKit/commit/57fe702497349c44e516699e352e1fa3ea146036
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-19 (Sat, 19 Sep 2026)
Changed paths:
M
Source/WebCore/platform/graphics/avfoundation/objc/CDMInstanceFairPlayStreamingAVFObjC.mm
Log Message:
-----------
CDMInstanceSessionFairPlayStreamingAVFObjC::didProvideRenewingRequest()
dereferences empty keyIDs vector
https://bugs.webkit.org/show_bug.cgi?id=324304
rdar://187533371
Reviewed by Jean-Yves Avenard.
didProvideRenewingRequest() calls keyIDs.first() to build the content
identifier without first checking whether keyIDsForRequest() returned an
empty vector, unlike every sibling path that follows the same pattern:
didProvideRequest() guards with keyIDs.isEmpty() before its .first() call,
and updateLicense() does the same. The keyIDs are derived from the
AVContentKeyRequest identifier supplied by AVFoundation, which can be
empty, so first() on an empty Vector is an out-of-bounds access.
Add the same isEmpty() guard used by didProvideRequest()/updateLicense(),
failing the update through m_updateLicenseCallback (matching this
function's existing @catch handler) before dereferencing.
This path is only reachable through a live FairPlay Streaming license
renewal driven by AVFoundation and is not exercisable from layout tests
(which use the mock CDM) or API tests, so no test accompanies this
defensive fix.
*
Source/WebCore/platform/graphics/avfoundation/objc/CDMInstanceFairPlayStreamingAVFObjC.mm:
(WebCore::CDMInstanceSessionFairPlayStreamingAVFObjC::didProvideRenewingRequest):
Canonical link: https://commits.webkit.org/321453@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
