IPC::decodeObject null dereference in decodeArrayInternal()

[Ian Gilbert]

decodeObject can return { nullptr }, which is a valid object but doesn't have a value. decodeArrayInternal checks that an object is returned but not that a value can be resolved.

[Ian Gilbert]

<rdar://problem/74599877>

[Ian Gilbert]

Filed this as security but I'm pretty sure it isn't.

[Ian Gilbert]

Created attachment 425223 [details]
Patch

[Ryosuke Niwa]

Comment on attachment 425223 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=425223&action=review

> LayoutTests/ipc/decode-object-array-crash.html:13
> +</script>

Can we spit out PASS here like this?
document.write('PASS')
so that we can be sure that the code ran 'til completion instead of exiting early due to syntax error, etc...

[Ian Gilbert]

Created attachment 425238 [details]
Patch

[Ryosuke Niwa]

Comment on attachment 425238 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=425238&action=review

> LayoutTests/ipc/decode-object-array-crash.html:13
> +    document.write('PASS')

oh, put this after if!

[Ryosuke Niwa]

Comment on attachment 425238 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=425238&action=review

> LayoutTests/ipc/decode-object-array-crash.html:4
> +Test passes if it does not crash.

Also, please wrap this in <p>~</p>

[Ian Gilbert]

Created attachment 425248 [details]
Patch

[EWS]

commit-queue failed to commit attachment 425248 [details] to WebKit repository. To retry, please set cq+ flag again.

[Ryosuke Niwa]

Comment on attachment 425248 [details]
Patch

Clearing flags on attachment: 425248

Committed r275501 (236158@main): <https://commits.webkit.org/236158@main>

[Ryosuke Niwa]

All reviewed patches have been landed.  Closing bug.