mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 18:37:35 +00:00
LibWeb: Fix UAF in convert_header_names_to_a_sorted_lowercase_set()
We can't keep a span (ReadonlyBytes) to a move()'d ByteBuffer in the header_names_seen HashTable - copy the original name span instead which works the same thanks to CaseInsensitiveBytesTraits. This would sporadically fail the contains() check due to garbage data, later leading to a VERIFY() crash in the OrderedHashTable append loop.
This commit is contained in:
parent
92cb32b905
commit
6bce48e99b
1 changed files with 1 additions and 1 deletions
|
@ -352,7 +352,7 @@ ErrorOr<OrderedHashTable<ByteBuffer>> convert_header_names_to_a_sorted_lowercase
|
|||
continue;
|
||||
auto bytes = TRY(ByteBuffer::copy(name));
|
||||
Infra::byte_lowercase(bytes);
|
||||
header_names_seen.set(bytes);
|
||||
header_names_seen.set(name);
|
||||
header_names_set.append(move(bytes));
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue