241813 2022-06-21 11:50:24 -0700 std::variant decoding with out-of-bounds index should fail instead of decoding the 0'th type 2022-06-28 00:41:30 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 achristensen achristensen cdumez kkinnunen webkit-bug-importer oldest_to_newest 1877013 0 achristensen 2022-06-21 11:50:24 -0700 Doesn't really decrease any powers of a compromised process, but IPC bounds checks are generally a good idea. This prevents a debug assertion in fuzzers. 1877014 1 460377 achristensen 2022-06-21 11:51:35 -0700 Created attachment 460377 Patch 1877015 2 achristensen 2022-06-21 11:58:38 -0700 See rdar://82979527 1877017 3 460377 cdumez 2022-06-21 12:46:24 -0700 Comment on attachment 460377 Patch r=me 1877204 4 ews-feeder 2022-06-21 20:23:03 -0700 Committed r295719 (251724@main): <https://commits.webkit.org/251724@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 460377. 1877206 5 webkit-bug-importer 2022-06-21 20:24:13 -0700 <rdar://problem/95657318> 1878694 6 kkinnunen 2022-06-28 00:41:30 -0700 FWIW, the added `if` is actually dead code since bug 241547, as there are no callers with `i != index`. It's just an artefact of how the recursion for variadic templates is written. E.g. there's no fuzzer in the world that would've hit that assertion. 460377 2022-06-21 11:51:35 -0700 2022-06-21 20:23:04 -0700 Patch bug-241813-20220621115134.patch text/plain 1187 achristensen RnJvbSBjNWQ1MWQ3MzFhNWRmMTA3NjVkZDZkZmMyODdkMzYwODYxNWUwMjkzIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBbGV4IENocmlzdGVuc2VuIDxhY2hyaXN0ZW5zZW5AYXBwbGUu Y29tPgpEYXRlOiBUdWUsIDIxIEp1biAyMDIyIDExOjUwOjM0IC0wNzAwClN1YmplY3Q6IFtQQVRD SF0gc3RkOjp2YXJpYW50IGRlY29kaW5nIHdpdGggb3V0LW9mLWJvdW5kcyBpbmRleCBzaG91bGQg ZmFpbAogaW5zdGVhZCBvZiBkZWNvZGluZyB0aGUgMCd0aCB0eXBlCiBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjQxODEzCgpSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KCiogU291cmNlL1dlYktpdC9QbGF0Zm9ybS9JUEMvQXJndW1lbnRDb2RlcnMuaDoKLS0tCiBT b3VyY2UvV2ViS2l0L1BsYXRmb3JtL0lQQy9Bcmd1bWVudENvZGVycy5oIHwgMyArKy0KIDEgZmls ZSBjaGFuZ2VkLCAyIGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViS2l0L1BsYXRmb3JtL0lQQy9Bcmd1bWVudENvZGVycy5oIGIvU291cmNlL1dlYktp dC9QbGF0Zm9ybS9JUEMvQXJndW1lbnRDb2RlcnMuaAppbmRleCBmNDcxNTcwMGM4YjIuLjcyNDc3 MDk1MGFkYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9QbGF0Zm9ybS9JUEMvQXJndW1lbnRD b2RlcnMuaAorKysgYi9Tb3VyY2UvV2ViS2l0L1BsYXRmb3JtL0lQQy9Bcmd1bWVudENvZGVycy5o CkBAIC04MzYsNyArODM2LDggQEAgc3RydWN0IFZhcmlhbnRDb2RlcjwwLCBUeXBlcy4uLj4gewog ICAgIHRlbXBsYXRlPHR5cGVuYW1lIERlY29kZXI+CiAgICAgc3RhdGljIHN0ZDo6b3B0aW9uYWw8 c3RkOjp2YXJpYW50PFR5cGVzLi4uPj4gZGVjb2RlKERlY29kZXImIGRlY29kZXIsIHVuc2lnbmVk IGkpCiAgICAgewotICAgICAgICBBU1NFUlRfVU5VU0VEKGksICFpKTsKKyAgICAgICAgaWYgKGkp CisgICAgICAgICAgICByZXR1cm4gc3RkOjpudWxsb3B0OwogICAgICAgICBzdGQ6Om9wdGlvbmFs PHR5cGVuYW1lIHN0ZDo6dmFyaWFudF9hbHRlcm5hdGl2ZTwwLCBzdGQ6OnZhcmlhbnQ8VHlwZXMu Li4+Pjo6dHlwZT4gb3B0aW9uYWw7CiAgICAgICAgIGRlY29kZXIgPj4gb3B0aW9uYWw7CiAgICAg ICAgIGlmICghb3B0aW9uYWwpCi0tIAoyLjMyLjAgKEFwcGxlIEdpdC0xMzIpCgo=