Bug 159663 – [WK2] Protect against bad database data in LocalStorageDatabase::importItems()

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

Protect against bad database data in LocalStorageDatabase::importItems(). We crash if the database contains a null key or a null value so protect against it given that we have evidence it can happen.

[Chris Dumez]

<rdar://problem/18995873>

[Chris Dumez]

Created attachment 283386 [details]
Patch

[Benjamin Poulain]

Comment on attachment 283386 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=283386&action=review

> Source/WebKit2/ChangeLog:3
> +        [WK2] Protect against bad database data in LocalStorageDatabase::importItems()

Why no test? Especially since you can reproduce?

[Chris Dumez]

(In reply to comment #3)
> Comment on attachment 283386 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=283386&action=review
> 
> > Source/WebKit2/ChangeLog:3
> > +        [WK2] Protect against bad database data in LocalStorageDatabase::importItems()
> 
> Why no test? Especially since you can reproduce?

We do not know how we can end up with null entries in the database. I can reproduce the crash only by using the database a user provided. See radar for more info.

[Brady Eidson]

(In reply to comment #4)
> (In reply to comment #3)
> > Comment on attachment 283386 [details]
> > Patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=283386&action=review
> > 
> > > Source/WebKit2/ChangeLog:3
> > > +        [WK2] Protect against bad database data in LocalStorageDatabase::importItems()
> > 
> > Why no test? Especially since you can reproduce?
> 
> We do not know how we can end up with null entries in the database. I can
> reproduce the crash only by using the database a user provided. See radar
> for more info.

I recently added an API test with bad SQLite database files; It's unknown how to generate those bad SQLite DB files, but it is known what happens once you have them.

So you should actually be able to test this.

Take a look at the API test IDBDeleteRecovery.

[Chris Dumez]

(In reply to comment #5)
> (In reply to comment #4)
> > (In reply to comment #3)
> > > Comment on attachment 283386 [details]
> > > Patch
> > > 
> > > View in context:
> > > https://bugs.webkit.org/attachment.cgi?id=283386&action=review
> > > 
> > > > Source/WebKit2/ChangeLog:3
> > > > +        [WK2] Protect against bad database data in LocalStorageDatabase::importItems()
> > > 
> > > Why no test? Especially since you can reproduce?
> > 
> > We do not know how we can end up with null entries in the database. I can
> > reproduce the crash only by using the database a user provided. See radar
> > for more info.
> 
> I recently added an API test with bad SQLite database files; It's unknown
> how to generate those bad SQLite DB files, but it is known what happens once
> you have them.
> 
> So you should actually be able to test this.
> 
> Take a look at the API test IDBDeleteRecovery.

Thanks for the info, I am working on it.

[Chris Dumez]

Created attachment 283435 [details]
Patch

[Chris Dumez]

Created attachment 283445 [details]
Patch

[Chris Dumez]

Comment on attachment 283445 [details]
Patch

Clearing flags on attachment: 283445

Committed r203129: <http://trac.webkit.org/changeset/203129>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.