RESOLVED FIXED327077
[GCrypt] Exporting an RSA key with a zero component crashes 
https://bugs.webkit.org/show_bug.cgi?id=327077
Summary [GCrypt] Exporting an RSA key with a zero component crashes
Claudio Saavedra
Reported 2026-10-10 00:05:31 PDT
.
Attachments
Add attachment proposed patch, testcase, etc.
Claudio Saavedra
Comment 1 2026-10-10 00:06:05 PDT
Pull request: https://github.com/WebKit/WebKit/pull/76577
Claudio Saavedra
Comment 2 2026-10-10 00:06:50 PDT
*** Program crashed: Bad pointer dereference at 0x00000000bbadbeef *** Thread 0 "WPEWebProcess" crashed: 0 WTFCrash + 9 1 [ra] WTF::CrashOnOverflow::crash() + 8 2 [ra] WTF::CrashOnOverflow::overflowed() + 8 3 [ra] WebCore::mpiSignedData(gcry_sexp*) + 222 4 [ra] WebCore::CryptoKeyRSA::exportSpki() const + 164 5 [ra] WebCore::CryptoAlgorithmRSA_OAEP::exportKey(WebCore::CryptoKeyFormat, WTF::Ref<WebCore::CryptoKey>&&, WTF::Function<...>&&, WTF::Function<void (WebCore::ExceptionCode)>&&) + 346 6 [ra] WebCore::SubtleCrypto::exportKey(WebCore::CryptoKeyFormat, WebCore::CryptoKey&, WTF::Ref<WebCore::DeferredPromise>&&) + 388 7 [ra] WebCore::jsSubtleCryptoPrototypeFunction_exportKey(JSC::JSGlobalObject*, JSC::CallFrame*) + 991 8 [ra] <JIT code> 9 [ra] llint_op_call + 186 10 [ra] llint_call_javascript + 5 11 [ra] JSC::asyncFunctionGeneratorBodyCall(...) + 3151 12 [ra] JSC::runInternalMicrotask(...) + 1650 13 [ra] JSC::MicrotaskQueue::drainWithoutUseCallOnEachMicrotask(...) + 604 14 [ra] WebCore::MicrotaskQueue::performMicrotaskCheckpoint(JSC::VM&) + 402
EWS
Comment 3 2026-10-12 03:26:03 PDT
Committed 323448@main (e6cec05c0d9b): <https://commits.webkit.org/323448@main> Reviewed commits have been landed. Closing PR #76577 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.