210621 2020-04-16 15:14:33 -0700 -[WebPreferences initWithCoder:] should use -[NSCoder decodeValueOfObjCType:at:size:] 2021-08-15 08:38:08 -0700 0 0 1 Unclassified Security Security WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=229121 InRadar P2 Normal --- 1 ddkilzer ddkilzer andersca bfulgham darin ews-feeder product-security webkit-bug-importer oldest_to_newest 1642445 0 ddkilzer 2020-04-16 15:14:33 -0700 -[WebPreferences initWithCoder:] should use -[NSCoder decodeValueOfObjCType:at:size:]. Found by clang static analyzer: Deprecated method '-decodeValueOfObjCType:at:' is insecure as it can lead to potential buffer overflows. Use the safer '-decodeValueOfObjCType:at:size:' method 1642446 1 webkit-bug-importer 2020-04-16 15:14:45 -0700 <rdar://problem/61906458> 1642448 2 396705 ddkilzer 2020-04-16 15:19:46 -0700 Created attachment 396705 Patch v1 1642449 3 396706 ddkilzer 2020-04-16 15:20:18 -0700 Created attachment 396706 Patch v1 1642450 4 ddkilzer 2020-04-16 15:21:37 -0700 (In reply to David Kilzer (:ddkilzer) from comment #3) > Created attachment 396706 [details] > Patch v1 Tired. Uploaded the same patch twice. 1642510 5 396722 ddkilzer 2020-04-16 16:45:56 -0700 Created attachment 396722 Patch v1 third time Sigh. EWS bots won't let me rebuild an obsoleted patch, even if I un-obsolete it. 1642901 6 ddkilzer 2020-04-17 16:55:27 -0700 Patch is ready for review. 1643008 7 ews-feeder 2020-04-18 09:33:08 -0700 Committed r260315: <https://trac.webkit.org/changeset/260315> All reviewed patches have been landed. Closing bug and clearing flags on attachment 396722. 396705 2020-04-16 15:19:46 -0700 2020-04-16 16:45:56 -0700 Patch v1 bug-210621-20200416152057.patch text/plain 1651 ddkilzer U3VidmVyc2lvbiBSZXZpc2lvbjogMjYwMjE2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0TGVn YWN5L21hYy9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0TGVnYWN5L21hYy9DaGFuZ2VMb2cKaW5k ZXggOTg3ZDU1NjMwZWZhZDQ1ZmM0N2ZlZjc1ZTI1ZDE0MDE2YTVlZDg3YS4uNTZhOTAyNGM3NTg4 NGU3MzY4NDkzYTRmN2NiYzA4YjNiNTBkNDY1OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdExl Z2FjeS9tYWMvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvbWFjL0NoYW5nZUxv ZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA0LTE2ICBEYXZpZCBLaWx6ZXIgIDxkZGtpbHplckBh cHBsZS5jb20+CisKKyAgICAgICAgLVtXZWJQcmVmZXJlbmNlcyBpbml0V2l0aENvZGVyOl0gc2hv dWxkIHVzZSAtW05TQ29kZXIgZGVjb2RlVmFsdWVPZk9iakNUeXBlOmF0OnNpemU6XQorICAgICAg ICA8aHR0cHM6Ly93ZWJraXQub3JnL2IvMjEwNjIxPgorICAgICAgICA8cmRhcjovL3Byb2JsZW0v NjE5MDY0NTg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgKiBXZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tOgorICAgICAgICAoLVtXZWJQcmVmZXJlbmNl cyBpbml0V2l0aENvZGVyOl0pOgorICAgICAgICAtIFN3aXRjaCB0byAtW05TQ29kZXIgZGVjb2Rl VmFsdWVPZk9iakNUeXBlOmF0OnNpemU6XS4KKwogMjAyMC0wNC0xMyAgVGltIEhvcnRvbiAgPHRp bW90aHlfaG9ydG9uQGFwcGxlLmNvbT4KIAogICAgICAgICBSRUdSRVNTSU9OIChyMjU5ODQzKTog Ik1pc3NpbmcgUGx1Zy1JbiIgd2hlbiBkcmFnZ2luZyBhbiBpbWFnZSBpbnRvIE1haWwgQ29tcG9z ZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdExlZ2FjeS9tYWMvV2ViVmlldy9XZWJQcmVmZXJl bmNlcy5tbSBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvbWFjL1dlYlZpZXcvV2ViUHJlZmVyZW5jZXMu bW0KaW5kZXggMTgwOTI5YzRkMWY2OTdmNzA0MTk4YzNkOWM4Yzg1MmJkNmRlNjljMi4uYmE3YTU3 NDEyZTU2ZDY5MDBlNmEyZWU3YzIzMjNhYzhiYzkyZDYxNyAxMDA2NDQKLS0tIGEvU291cmNlL1dl YktpdExlZ2FjeS9tYWMvV2ViVmlldy9XZWJQcmVmZXJlbmNlcy5tbQorKysgYi9Tb3VyY2UvV2Vi S2l0TGVnYWN5L21hYy9XZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tCkBAIC0zMDAsNyArMzAwLDcg QEAgLSAoaW5zdGFuY2V0eXBlKWluaXRXaXRoQ29kZXI6KE5TQ29kZXIgKilkZWNvZGVyCiAgICAg ICAgICAgICB2YWx1ZXMgPSBbZGVjb2RlciBkZWNvZGVPYmplY3RGb3JLZXk6QCJWYWx1ZXMiXTsK ICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgIGludCB2ZXJzaW9uOwotICAgICAgICAgICAg W2RlY29kZXIgZGVjb2RlVmFsdWVPZk9iakNUeXBlOkBlbmNvZGUoaW50KSBhdDomdmVyc2lvbl07 CisgICAgICAgICAgICBbZGVjb2RlciBkZWNvZGVWYWx1ZU9mT2JqQ1R5cGU6QGVuY29kZShpbnQp IGF0OiZ2ZXJzaW9uIHNpemU6c2l6ZW9mKGludCldOwogICAgICAgICAgICAgaWYgKHZlcnNpb24g PT0gMSkgewogICAgICAgICAgICAgICAgIGlkZW50aWZpZXIgPSBbZGVjb2RlciBkZWNvZGVPYmpl Y3RdOwogICAgICAgICAgICAgICAgIHZhbHVlcyA9IFtkZWNvZGVyIGRlY29kZU9iamVjdF07Cg== 396706 2020-04-16 15:20:18 -0700 2020-04-16 15:21:17 -0700 Patch v1 bug-210621-20200416152130.patch text/plain 1651 ddkilzer U3VidmVyc2lvbiBSZXZpc2lvbjogMjYwMjE2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0TGVn YWN5L21hYy9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0TGVnYWN5L21hYy9DaGFuZ2VMb2cKaW5k ZXggOTg3ZDU1NjMwZWZhZDQ1ZmM0N2ZlZjc1ZTI1ZDE0MDE2YTVlZDg3YS4uNTZhOTAyNGM3NTg4 NGU3MzY4NDkzYTRmN2NiYzA4YjNiNTBkNDY1OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdExl Z2FjeS9tYWMvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvbWFjL0NoYW5nZUxv ZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA0LTE2ICBEYXZpZCBLaWx6ZXIgIDxkZGtpbHplckBh cHBsZS5jb20+CisKKyAgICAgICAgLVtXZWJQcmVmZXJlbmNlcyBpbml0V2l0aENvZGVyOl0gc2hv dWxkIHVzZSAtW05TQ29kZXIgZGVjb2RlVmFsdWVPZk9iakNUeXBlOmF0OnNpemU6XQorICAgICAg ICA8aHR0cHM6Ly93ZWJraXQub3JnL2IvMjEwNjIxPgorICAgICAgICA8cmRhcjovL3Byb2JsZW0v NjE5MDY0NTg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgKiBXZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tOgorICAgICAgICAoLVtXZWJQcmVmZXJlbmNl cyBpbml0V2l0aENvZGVyOl0pOgorICAgICAgICAtIFN3aXRjaCB0byAtW05TQ29kZXIgZGVjb2Rl VmFsdWVPZk9iakNUeXBlOmF0OnNpemU6XS4KKwogMjAyMC0wNC0xMyAgVGltIEhvcnRvbiAgPHRp bW90aHlfaG9ydG9uQGFwcGxlLmNvbT4KIAogICAgICAgICBSRUdSRVNTSU9OIChyMjU5ODQzKTog Ik1pc3NpbmcgUGx1Zy1JbiIgd2hlbiBkcmFnZ2luZyBhbiBpbWFnZSBpbnRvIE1haWwgQ29tcG9z ZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdExlZ2FjeS9tYWMvV2ViVmlldy9XZWJQcmVmZXJl bmNlcy5tbSBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvbWFjL1dlYlZpZXcvV2ViUHJlZmVyZW5jZXMu bW0KaW5kZXggMTgwOTI5YzRkMWY2OTdmNzA0MTk4YzNkOWM4Yzg1MmJkNmRlNjljMi4uYmE3YTU3 NDEyZTU2ZDY5MDBlNmEyZWU3YzIzMjNhYzhiYzkyZDYxNyAxMDA2NDQKLS0tIGEvU291cmNlL1dl YktpdExlZ2FjeS9tYWMvV2ViVmlldy9XZWJQcmVmZXJlbmNlcy5tbQorKysgYi9Tb3VyY2UvV2Vi S2l0TGVnYWN5L21hYy9XZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tCkBAIC0zMDAsNyArMzAwLDcg QEAgLSAoaW5zdGFuY2V0eXBlKWluaXRXaXRoQ29kZXI6KE5TQ29kZXIgKilkZWNvZGVyCiAgICAg ICAgICAgICB2YWx1ZXMgPSBbZGVjb2RlciBkZWNvZGVPYmplY3RGb3JLZXk6QCJWYWx1ZXMiXTsK ICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgIGludCB2ZXJzaW9uOwotICAgICAgICAgICAg W2RlY29kZXIgZGVjb2RlVmFsdWVPZk9iakNUeXBlOkBlbmNvZGUoaW50KSBhdDomdmVyc2lvbl07 CisgICAgICAgICAgICBbZGVjb2RlciBkZWNvZGVWYWx1ZU9mT2JqQ1R5cGU6QGVuY29kZShpbnQp IGF0OiZ2ZXJzaW9uIHNpemU6c2l6ZW9mKGludCldOwogICAgICAgICAgICAgaWYgKHZlcnNpb24g PT0gMSkgewogICAgICAgICAgICAgICAgIGlkZW50aWZpZXIgPSBbZGVjb2RlciBkZWNvZGVPYmpl Y3RdOwogICAgICAgICAgICAgICAgIHZhbHVlcyA9IFtkZWNvZGVyIGRlY29kZU9iamVjdF07Cg== 396722 2020-04-16 16:45:56 -0700 2020-04-18 09:33:08 -0700 Patch v1 third time bug-210621-20200416152057.patch text/plain 1651 ddkilzer U3VidmVyc2lvbiBSZXZpc2lvbjogMjYwMjE2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0TGVn YWN5L21hYy9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0TGVnYWN5L21hYy9DaGFuZ2VMb2cKaW5k ZXggOTg3ZDU1NjMwZWZhZDQ1ZmM0N2ZlZjc1ZTI1ZDE0MDE2YTVlZDg3YS4uNTZhOTAyNGM3NTg4 NGU3MzY4NDkzYTRmN2NiYzA4YjNiNTBkNDY1OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdExl Z2FjeS9tYWMvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvbWFjL0NoYW5nZUxv ZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA0LTE2ICBEYXZpZCBLaWx6ZXIgIDxkZGtpbHplckBh cHBsZS5jb20+CisKKyAgICAgICAgLVtXZWJQcmVmZXJlbmNlcyBpbml0V2l0aENvZGVyOl0gc2hv dWxkIHVzZSAtW05TQ29kZXIgZGVjb2RlVmFsdWVPZk9iakNUeXBlOmF0OnNpemU6XQorICAgICAg ICA8aHR0cHM6Ly93ZWJraXQub3JnL2IvMjEwNjIxPgorICAgICAgICA8cmRhcjovL3Byb2JsZW0v NjE5MDY0NTg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgKiBXZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tOgorICAgICAgICAoLVtXZWJQcmVmZXJlbmNl cyBpbml0V2l0aENvZGVyOl0pOgorICAgICAgICAtIFN3aXRjaCB0byAtW05TQ29kZXIgZGVjb2Rl VmFsdWVPZk9iakNUeXBlOmF0OnNpemU6XS4KKwogMjAyMC0wNC0xMyAgVGltIEhvcnRvbiAgPHRp bW90aHlfaG9ydG9uQGFwcGxlLmNvbT4KIAogICAgICAgICBSRUdSRVNTSU9OIChyMjU5ODQzKTog Ik1pc3NpbmcgUGx1Zy1JbiIgd2hlbiBkcmFnZ2luZyBhbiBpbWFnZSBpbnRvIE1haWwgQ29tcG9z ZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdExlZ2FjeS9tYWMvV2ViVmlldy9XZWJQcmVmZXJl bmNlcy5tbSBiL1NvdXJjZS9XZWJLaXRMZWdhY3kvbWFjL1dlYlZpZXcvV2ViUHJlZmVyZW5jZXMu bW0KaW5kZXggMTgwOTI5YzRkMWY2OTdmNzA0MTk4YzNkOWM4Yzg1MmJkNmRlNjljMi4uYmE3YTU3 NDEyZTU2ZDY5MDBlNmEyZWU3YzIzMjNhYzhiYzkyZDYxNyAxMDA2NDQKLS0tIGEvU291cmNlL1dl YktpdExlZ2FjeS9tYWMvV2ViVmlldy9XZWJQcmVmZXJlbmNlcy5tbQorKysgYi9Tb3VyY2UvV2Vi S2l0TGVnYWN5L21hYy9XZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tCkBAIC0zMDAsNyArMzAwLDcg QEAgLSAoaW5zdGFuY2V0eXBlKWluaXRXaXRoQ29kZXI6KE5TQ29kZXIgKilkZWNvZGVyCiAgICAg ICAgICAgICB2YWx1ZXMgPSBbZGVjb2RlciBkZWNvZGVPYmplY3RGb3JLZXk6QCJWYWx1ZXMiXTsK ICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgIGludCB2ZXJzaW9uOwotICAgICAgICAgICAg W2RlY29kZXIgZGVjb2RlVmFsdWVPZk9iakNUeXBlOkBlbmNvZGUoaW50KSBhdDomdmVyc2lvbl07 CisgICAgICAgICAgICBbZGVjb2RlciBkZWNvZGVWYWx1ZU9mT2JqQ1R5cGU6QGVuY29kZShpbnQp IGF0OiZ2ZXJzaW9uIHNpemU6c2l6ZW9mKGludCldOwogICAgICAgICAgICAgaWYgKHZlcnNpb24g PT0gMSkgewogICAgICAgICAgICAgICAgIGlkZW50aWZpZXIgPSBbZGVjb2RlciBkZWNvZGVPYmpl Y3RdOwogICAgICAgICAgICAgICAgIHZhbHVlcyA9IFtkZWNvZGVyIGRlY29kZU9iamVjdF07Cg==