mirror of
https://github.com/fergalmoran/ladybird.git
synced 2026-01-06 00:25:12 +00:00
LibWeb: Fix UAF in convert_header_names_to_a_sorted_lowercase_set()
We can't keep a span (ReadonlyBytes) to a move()'d ByteBuffer in the header_names_seen HashTable - copy the original name span instead which works the same thanks to CaseInsensitiveBytesTraits. This would sporadically fail the contains() check due to garbage data, later leading to a VERIFY() crash in the OrderedHashTable append loop.
This commit is contained in:
@@ -352,7 +352,7 @@ ErrorOr<OrderedHashTable<ByteBuffer>> convert_header_names_to_a_sorted_lowercase
|
||||
continue;
|
||||
auto bytes = TRY(ByteBuffer::copy(name));
|
||||
Infra::byte_lowercase(bytes);
|
||||
header_names_seen.set(bytes);
|
||||
header_names_seen.set(name);
|
||||
header_names_set.append(move(bytes));
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user