1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 18:37:35 +00:00

LibWeb: Fix UAF in convert_header_names_to_a_sorted_lowercase_set()

We can't keep a span (ReadonlyBytes) to a move()'d ByteBuffer
in the header_names_seen HashTable - copy the original name span instead
which works the same thanks to CaseInsensitiveBytesTraits.

This would sporadically fail the contains() check due to garbage data,
later leading to a VERIFY() crash in the OrderedHashTable append loop.
This commit is contained in:
Linus Groh 2023-02-10 21:58:10 +00:00
parent 92cb32b905
commit 6bce48e99b

View file

@ -352,7 +352,7 @@ ErrorOr<OrderedHashTable<ByteBuffer>> convert_header_names_to_a_sorted_lowercase
continue;
auto bytes = TRY(ByteBuffer::copy(name));
Infra::byte_lowercase(bytes);
header_names_seen.set(bytes);
header_names_seen.set(name);
header_names_set.append(move(bytes));
}