198388 2019-05-30 13:24:39 -0700 Network process crash when decoding SecItemResponseData 2019-05-31 08:50:33 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez achristensen beidson commit-queue ggaren mitz rniwa timothy webkit-bug-importer oldest_to_newest 1540441 0 cdumez 2019-05-30 13:24:39 -0700 Network process crash when decoding SecItemResponseData: Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFY Application Specific Information: *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[__NSArrayM insertObject:atIndex:]: object cannot be nil' terminating with uncaught exception of type NSException abort() called Application Specific Backtrace 1: 0 CoreFoundation 0x00007fff49efcd49 __exceptionPreprocess + 256 1 libobjc.A.dylib 0x00007fff750f8a17 objc_exception_throw + 48 2 CoreFoundation 0x00007fff49f3bd44 -[CFPrefsConfigurationFileSource initWithConfigurationPropertyList:containingPreferences:] + 0 3 CoreFoundation 0x00007fff49e388dc -[__NSArrayM insertObject:atIndex:] + 1216 4 WebKit 0x000000010eaa8dc4 _ZN3IPC6decodeERNS_7DecoderERN3WTF9RetainPtrIPK9__CFArrayEE + 172 5 WebKit 0x000000010eaa8ae9 _ZN3IPC6decodeERNS_7DecoderERN3WTF9RetainPtrIPKvEE + 82 6 WebKit 0x000000010ec5d9e9 _ZN6WebKit19SecItemResponseData6decodeERN3IPC7DecoderE + 77 7 WebKit 0x000000010ec5e0bc _ZN3IPC7DecoderrsIN6WebKit19SecItemResponseDataELPv0EEERS0_RN3WTF8OptionalIT_EE + 34 8 WebKit 0x000000010ec5e051 _ZN3IPC16TupleDecoderImplIN6WebKit19SecItemResponseDataEJEE6decodeERNS_7DecoderE + 41 9 WebKit 0x000000010ec5def8 _ZN3IPC7DecoderrsINSt3__15tupleIJN6WebKit19SecItemResponseDataEEEELPv0EEERS0_RN3WTF8OptionalIT_EE + 34 10 WebKit 0x000000010ec5de40 _ZZN3IPC10Connection13sendWithReplyIN8Messages16SecItemShimProxy14SecItemRequestEEEvOT_yRN3WTF18FunctionDispatcherEONS7_8FunctionIFvNS7_8OptionalINS_10CodingTypeINS5_5ReplyEE4TypeEEEEEEENKUlNSt3__110unique_ptrINS_7DecoderENSK_14default_deleteISM_EEEEE_clESP_ + 46 11 WebKit 0x000000010ec5ddec _ZN3WTF8FunctionIFvNSt3__110unique_ptrIN3IPC7DecoderENS1_14default_deleteIS4_EEEEEE15CallableWrapperIZNS3_10Connection13sendWithReplyIN8Messages16SecItemShimProxy14SecItemRequestEEEvOT_yRNS_18FunctionDispatcherEONS0_IFvNS_8OptionalINS3_10CodingTypeINSG_5ReplyEE4TypeEEEEEEEUlS7_E_E4callES7_ + 38 12 WebKit 0x000000010eabd325 _ZNK3WTF8FunctionIFvNSt3__110unique_ptrIN3IPC7DecoderENS1_14default_deleteIS4_EEEEEEclES7_ + 41 13 WebKit 0x000000010eabe107 _ZN3WTF8FunctionIFvvEE15CallableWrapperIZN3IPC10Connection24processIncomingSyncReplyENSt3__110unique_ptrINS4_7DecoderENS6_14default_deleteIS8_EEEEE3$_8E4callEv + 67 1540442 1 cdumez 2019-05-30 13:25:03 -0700 <rdar://problem/50408046> 1540447 2 370975 cdumez 2019-05-30 13:30:29 -0700 Created attachment 370975 Patch 1540504 3 370975 achristensen 2019-05-30 16:23:30 -0700 Comment on attachment 370975 Patch may as well 1540521 4 370975 commit-queue 2019-05-30 17:00:14 -0700 Comment on attachment 370975 Patch Clearing flags on attachment: 370975 Committed r245911: <https://trac.webkit.org/changeset/245911> 1540522 5 commit-queue 2019-05-30 17:00:16 -0700 All reviewed patches have been landed. Closing bug. 1540546 6 mitz 2019-05-30 17:32:27 -0700 Does it really make sense for the length of the decoded array to be different from the length of the array that was encoded? 1540727 7 cdumez 2019-05-31 08:50:33 -0700 (In reply to mitz from comment #6) > Does it really make sense for the length of the decoded array to be > different from the length of the array that was encoded? The issue is that we're not always able to encode elements, or decode them. E.g. The SecIdentityRef encoder will not encode a key if copyPersistentRef() return null. The SecIdentityRef decoder, will not construct a SecIdentityRef if not key was encoded, or if the decoding process does not have ProcessPrivilege::CanAccessCredentials privilege. Yet decode() will return true in those cases. In theory, the SecCertificateRef decoder can also return true while not constructing a SecCertificateRef, if SecCertificateCreateWithData() returns null. 370975 2019-05-30 13:30:29 -0700 2019-05-30 17:00:14 -0700 Patch bug-198388-20190530133028.patch text/plain 5664 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ1ODk3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDg5ZGE4MGVhNjJhYTVlYjg5 ZDUxYWQwOTdhMWIyMDc1YjBkY2FkOWQuLjU5MGJiY2FmMGEwYzI4YzViOWZjNTQwNTM3MmIxYmY3 YjVjYmM3ODEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMzIgQEAKKzIwMTktMDUtMzAgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBOZXR3b3JrIHByb2Nlc3MgY3Jhc2gg d2hlbiBkZWNvZGluZyBTZWNJdGVtUmVzcG9uc2VEYXRhCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTgzODgKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVt LzUwNDA4MDQ2PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgICogU2hhcmVkL2NmL0FyZ3VtZW50Q29kZXJzQ0YuY3BwOgorICAgICAgICAoSVBDOjpkZWNv ZGUpOgorICAgICAgICBXaGVuIGRlY29kaW5nIHRoZSBlbGVtZW50cyBpbnNpZGUgYSBDRkFycmF5 UmVmLCBpZiBkZWNvZGluZyB3YXMgc3VjY2Vzc2Z1bCBidXQKKyAgICAgICAgdGhlIENGVHlwZVJl ZiBlbGVtZW50IGlzIHN0aWxsIG51bGwgdGhlbiBza2lwIGl0IGluc3RlYWQgb2YgdHJ5aW5nIHRv IGFwcGVuZCBpdAorICAgICAgICB0byB0aGUgYXJyYXkuIEEgQ0ZBcnJheSBjb250YWluZXIgaXMg bm90IGFsbG93ZWQgdG8gY29udGFpbiBudWxsLgorICAgICAgICBTb21lIG9mIG91ciBkZWNvZGVy cyBmb3IgQ0ZUeXBlUmVmIHR5cGVzIG1heSBub3QgaW5pdGlhbGl6ZSB0aGUgZWxlbWVudCBldmVu IGlmCisgICAgICAgIHRoZSBkZWNvZGUoKSBmdW5jdGlvbiByZXR1cm5zIHRydWUuIEZvciBleGFt cGxlLCB0aGUgZGVjb2RlcnMgZm9yIENGQXJyYXlSZWYgYW5kCisgICAgICAgIENGRGljdGlvbmFy eVJlZiByZXR1cm4gdHJ1ZSBpZiB0aGUgZW5jb2RlZCBjb250YWluZXIgd2FzIG51bGwgYnV0IGRv IG5vdCBjcmVhdGUKKyAgICAgICAgYSBjb250YWluZXIuCisKKyAgICAgICAgKiBTaGFyZWQvbWFj L1NlY0l0ZW1SZXNwb25zZURhdGEuY3BwOgorICAgICAgICAoV2ViS2l0OjpTZWNJdGVtUmVzcG9u c2VEYXRhOjpTZWNJdGVtUmVzcG9uc2VEYXRhKToKKyAgICAgICAgbml0OiBUaGUgd3JvbmcgcGFy YW1ldGVyIHdhcyBiZWluZyBtb3ZlZC4gVGhpcyBpcyBtb3JlIGVmZmljaWVudC4KKworICAgICAg ICAoV2ViS2l0OjpTZWNJdGVtUmVzcG9uc2VEYXRhOjplbmNvZGUgY29uc3QpOgorICAgICAgICBu aXQ6IERyb3AgdW5uZWNlc3NhcnkgLmdldCgpLgorCisgICAgICAgICogVUlQcm9jZXNzL21hYy9T ZWNJdGVtU2hpbVByb3h5LmNwcDoKKyAgICAgICAgKFdlYktpdDo6U2VjSXRlbVNoaW1Qcm94eTo6 c2VjSXRlbVJlcXVlc3QpOgorICAgICAgICBuaXQ6IFVzZSBudWxscHRyIGluc3RlYWQgb2YgMC4K KwogMjAxOS0wNS0zMCAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgogCiAgICAgICAg IFtpT1NdIFRoaXJkLXBhcnR5IGV4dGVuc2lvbnMgdXNpbmcgV0tXZWJWaWV3IGFyZSB1bmFibGUg dG8gcmVuZGVyIGFueXRoaW5nCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9jZi9B cmd1bWVudENvZGVyc0NGLmNwcCBiL1NvdXJjZS9XZWJLaXQvU2hhcmVkL2NmL0FyZ3VtZW50Q29k ZXJzQ0YuY3BwCmluZGV4IGZkYjhlODg1NzRkM2FkNTNhMmVhZjMyZDhhYmEwYjMzZTA5OGU3NDUu Ljg1YmViZDJhMmJmODIzNmU1ZTJmNzgyNGQ2MWE2ZWI5N2FmZGM5NjEgMTAwNjQ0Ci0tLSBhL1Nv dXJjZS9XZWJLaXQvU2hhcmVkL2NmL0FyZ3VtZW50Q29kZXJzQ0YuY3BwCisrKyBiL1NvdXJjZS9X ZWJLaXQvU2hhcmVkL2NmL0FyZ3VtZW50Q29kZXJzQ0YuY3BwCkBAIC0zNzEsMTMgKzM3MSwxNiBA QCBib29sIGRlY29kZShEZWNvZGVyJiBkZWNvZGVyLCBSZXRhaW5QdHI8Q0ZBcnJheVJlZj4mIHJl c3VsdCkKICAgICBpZiAoIWRlY29kZXIuZGVjb2RlKHNpemUpKQogICAgICAgICByZXR1cm4gZmFs c2U7CiAKLSAgICBSZXRhaW5QdHI8Q0ZNdXRhYmxlQXJyYXlSZWY+IGFycmF5ID0gYWRvcHRDRihD RkFycmF5Q3JlYXRlTXV0YWJsZSgwLCAwLCAma0NGVHlwZUFycmF5Q2FsbEJhY2tzKSk7CisgICAg YXV0byBhcnJheSA9IGFkb3B0Q0YoQ0ZBcnJheUNyZWF0ZU11dGFibGUoMCwgMCwgJmtDRlR5cGVB cnJheUNhbGxCYWNrcykpOwogCiAgICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPCBzaXplOyArK2kp IHsKICAgICAgICAgUmV0YWluUHRyPENGVHlwZVJlZj4gZWxlbWVudDsKICAgICAgICAgaWYgKCFk ZWNvZGUoZGVjb2RlciwgZWxlbWVudCkpCiAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CiAKKyAg ICAgICAgaWYgKCFlbGVtZW50KQorICAgICAgICAgICAgY29udGludWU7CisgICAgICAgIAogICAg ICAgICBDRkFycmF5QXBwZW5kVmFsdWUoYXJyYXkuZ2V0KCksIGVsZW1lbnQuZ2V0KCkpOwogICAg IH0KIApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9TaGFyZWQvbWFjL1NlY0l0ZW1SZXNwb25z ZURhdGEuY3BwIGIvU291cmNlL1dlYktpdC9TaGFyZWQvbWFjL1NlY0l0ZW1SZXNwb25zZURhdGEu Y3BwCmluZGV4IDQ2NmY2YWNiNmQwZGI4NDU3NzlmZWQwMDU5NTUzNmEwZTlkMjM5NDMuLmIyNTM0 ZWEyZDE0OTE2N2U5YmRlZWU3ZGFkOWViOWJkZWM2YWNlODEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJLaXQvU2hhcmVkL21hYy9TZWNJdGVtUmVzcG9uc2VEYXRhLmNwcAorKysgYi9Tb3VyY2UvV2Vi S2l0L1NoYXJlZC9tYWMvU2VjSXRlbVJlc3BvbnNlRGF0YS5jcHAKQEAgLTMyLDE1ICszMiwxNSBA QAogbmFtZXNwYWNlIFdlYktpdCB7CiAKIFNlY0l0ZW1SZXNwb25zZURhdGE6OlNlY0l0ZW1SZXNw b25zZURhdGEoT1NTdGF0dXMgcmVzdWx0Q29kZSwgUmV0YWluUHRyPENGVHlwZVJlZj4mJiByZXN1 bHRPYmplY3QpCi0gICAgOiBtX3Jlc3VsdE9iamVjdChyZXN1bHRPYmplY3QpCi0gICAgLCBtX3Jl c3VsdENvZGUoV1RGTW92ZShyZXN1bHRDb2RlKSkKKyAgICA6IG1fcmVzdWx0T2JqZWN0KFdURk1v dmUocmVzdWx0T2JqZWN0KSkKKyAgICAsIG1fcmVzdWx0Q29kZShyZXN1bHRDb2RlKQogewogfQog CiB2b2lkIFNlY0l0ZW1SZXNwb25zZURhdGE6OmVuY29kZShJUEM6OkVuY29kZXImIGVuY29kZXIp IGNvbnN0CiB7CiAgICAgZW5jb2RlciA8PCBzdGF0aWNfY2FzdDxpbnQ2NF90PihtX3Jlc3VsdENv ZGUpOwotICAgIGVuY29kZXIgPDwgc3RhdGljX2Nhc3Q8Ym9vbD4obV9yZXN1bHRPYmplY3QuZ2V0 KCkpOworICAgIGVuY29kZXIgPDwgc3RhdGljX2Nhc3Q8Ym9vbD4obV9yZXN1bHRPYmplY3QpOwog ICAgIGlmIChtX3Jlc3VsdE9iamVjdCkKICAgICAgICAgSVBDOjplbmNvZGUoZW5jb2RlciwgbV9y ZXN1bHRPYmplY3QuZ2V0KCkpOwogfQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9VSVByb2Nl c3MvbWFjL1NlY0l0ZW1TaGltUHJveHkuY3BwIGIvU291cmNlL1dlYktpdC9VSVByb2Nlc3MvbWFj L1NlY0l0ZW1TaGltUHJveHkuY3BwCmluZGV4IGQyYmI2OWE4NTIzN2M4MTc4Yjc0NWUzM2VhMDFk YjhkNzFiYmRjZTkuLmQxMmJmZjY3YTVkODkxOTUwYmI2MTRkYWFkODg2ZDE5NWVlZWViZDQgMTAw NjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvVUlQcm9jZXNzL21hYy9TZWNJdGVtU2hpbVByb3h5LmNw cAorKysgYi9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9tYWMvU2VjSXRlbVNoaW1Qcm94eS5jcHAK QEAgLTY1LDEzICs2NSwxMyBAQCB2b2lkIFNlY0l0ZW1TaGltUHJveHk6OnNlY0l0ZW1SZXF1ZXN0 KGNvbnN0IFNlY0l0ZW1SZXF1ZXN0RGF0YSYgcmVxdWVzdCwgQ29tcGxldAogICAgIHN3aXRjaCAo cmVxdWVzdC50eXBlKCkpIHsKICAgICBjYXNlIFNlY0l0ZW1SZXF1ZXN0RGF0YTo6SW52YWxpZDoK ICAgICAgICAgTE9HX0VSUk9SKCJTZWNJdGVtU2hpbVByb3h5OjpzZWNJdGVtUmVxdWVzdCByZWNl aXZlZCBhbiBpbnZhbGlkIGRhdGEgcmVxdWVzdC4gUGxlYXNlIGZpbGUgYSBidWcgaWYgeW91IGtu b3cgaG93IHlvdSBjYXVzZWQgdGhpcy4iKTsKLSAgICAgICAgcmVzcG9uc2UoU2VjSXRlbVJlc3Bv bnNlRGF0YShlcnJTZWNQYXJhbSwgbnVsbHB0cikpOworICAgICAgICByZXNwb25zZShTZWNJdGVt UmVzcG9uc2VEYXRhIHsgZXJyU2VjUGFyYW0sIG51bGxwdHIgfSk7CiAgICAgICAgIGJyZWFrOwog CiAgICAgY2FzZSBTZWNJdGVtUmVxdWVzdERhdGE6OkNvcHlNYXRjaGluZzogewotICAgICAgICBD RlR5cGVSZWYgcmVzdWx0T2JqZWN0ID0gMDsKKyAgICAgICAgQ0ZUeXBlUmVmIHJlc3VsdE9iamVj dCA9IG51bGxwdHI7CiAgICAgICAgIE9TU3RhdHVzIHJlc3VsdENvZGUgPSBTZWNJdGVtQ29weU1h dGNoaW5nKHJlcXVlc3QucXVlcnkoKSwgJnJlc3VsdE9iamVjdCk7Ci0gICAgICAgIHJlc3BvbnNl KFNlY0l0ZW1SZXNwb25zZURhdGEocmVzdWx0Q29kZSwgYWRvcHRDRihyZXN1bHRPYmplY3QpLmdl dCgpKSk7CisgICAgICAgIHJlc3BvbnNlKFNlY0l0ZW1SZXNwb25zZURhdGEgeyByZXN1bHRDb2Rl LCBhZG9wdENGKHJlc3VsdE9iamVjdCkgfSk7CiAgICAgICAgIGJyZWFrOwogICAgIH0KIApAQCAt NzksMTkgKzc5LDE5IEBAIHZvaWQgU2VjSXRlbVNoaW1Qcm94eTo6c2VjSXRlbVJlcXVlc3QoY29u c3QgU2VjSXRlbVJlcXVlc3REYXRhJiByZXF1ZXN0LCBDb21wbGV0CiAgICAgICAgIC8vIFJldHVy biB2YWx1ZSBvZiBTZWNJdGVtQWRkIGlzIG9mdGVuIGlnbm9yZWQuIEV2ZW4gaWYgaXQgaXNuJ3Qs IHdlIGRvbid0IGhhdmUgdGhlIGFiaWxpdHkgdG8KICAgICAgICAgLy8gc2VyaWFsaXplIFNlY0tl eWNoYWluSXRlbVJlZi4KICAgICAgICAgT1NTdGF0dXMgcmVzdWx0Q29kZSA9IFNlY0l0ZW1BZGQo cmVxdWVzdC5xdWVyeSgpLCBudWxscHRyKTsKLSAgICAgICAgcmVzcG9uc2UoU2VjSXRlbVJlc3Bv bnNlRGF0YShyZXN1bHRDb2RlLCBudWxscHRyKSk7CisgICAgICAgIHJlc3BvbnNlKFNlY0l0ZW1S ZXNwb25zZURhdGEgeyByZXN1bHRDb2RlLCBudWxscHRyIH0pOwogICAgICAgICBicmVhazsKICAg ICB9CiAKICAgICBjYXNlIFNlY0l0ZW1SZXF1ZXN0RGF0YTo6VXBkYXRlOiB7CiAgICAgICAgIE9T U3RhdHVzIHJlc3VsdENvZGUgPSBTZWNJdGVtVXBkYXRlKHJlcXVlc3QucXVlcnkoKSwgcmVxdWVz dC5hdHRyaWJ1dGVzVG9NYXRjaCgpKTsKLSAgICAgICAgcmVzcG9uc2UoU2VjSXRlbVJlc3BvbnNl RGF0YShyZXN1bHRDb2RlLCAwKSk7CisgICAgICAgIHJlc3BvbnNlKFNlY0l0ZW1SZXNwb25zZURh dGEgeyByZXN1bHRDb2RlLCBudWxscHRyIH0pOwogICAgICAgICBicmVhazsKICAgICB9CiAKICAg ICBjYXNlIFNlY0l0ZW1SZXF1ZXN0RGF0YTo6RGVsZXRlOiB7CiAgICAgICAgIE9TU3RhdHVzIHJl c3VsdENvZGUgPSBTZWNJdGVtRGVsZXRlKHJlcXVlc3QucXVlcnkoKSk7Ci0gICAgICAgIHJlc3Bv bnNlKFNlY0l0ZW1SZXNwb25zZURhdGEocmVzdWx0Q29kZSwgMCkpOworICAgICAgICByZXNwb25z ZShTZWNJdGVtUmVzcG9uc2VEYXRhIHsgcmVzdWx0Q29kZSwgbnVsbHB0ciB9KTsKICAgICAgICAg YnJlYWs7CiAgICAgfQogICAgIH0K