241547 2022-06-13 06:21:45 -0700 Ignore badly encoded std::variant IPC messages. 2022-06-14 16:55:26 -0700 1 1 1 Unclassified WebKit WebKit2 Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 jean-yves.avenard jean-yves.avenard kkinnunen webkit-bug-importer oldest_to_newest 1875511 0 jean-yves.avenard 2022-06-13 06:21:45 -0700 Seen in 241407 with the ipc/pasteboard-write-custom-data.html test It sends a rubbish buffer over IPC and ensure that the decoder doesn't crash. When using the std::variant<> decoder, the decoder performs a recursive call in order to decode the property type like so: std::variant<T1,T2,T3> obj; decode<std::variant<T1,T2,T3...>>() read std::variant's index into i. VariantCoder<2, Types...>::decode(decoder, *i); VariantCoder<1, Types...>::decode(decoder, *i); VariantCoder<0, Types...>::decode(decoder, *i); If the encoded value of i is nonsensical, we will get into calling VariantCoder<0, Types...>::decode(decoder, *i); We should exit early when we read the value of I if it's greater than the number of types en variant can contain. 1875512 1 webkit-bug-importer 2022-06-13 06:21:59 -0700 <rdar://problem/95016858> 1875519 2 jean-yves.avenard 2022-06-13 07:14:11 -0700 Pull request: https://github.com/WebKit/WebKit/pull/1472 1875914 3 ews-feeder 2022-06-14 16:55:25 -0700 Committed r295545 (251550@main): <https://commits.webkit.org/251550@main> Reviewed commits have been landed. Closing PR #1472 and removing active labels.