← WebKit — 2026-W37
560f0ec3582807f0a2867481e85a2cf112972eba CertificateInfo::containsNonRootSHA1SignedCertificate() bounds the certificate chain loop with a count from a separate SecTrust call
severity low
class OOB-read
confidence 0.45
signal score 6.25
Source/WebCore/platform
Primitive: Cert-chain loop could read past SecTrustCopyCertificateChain array or deref a null chain when its count disagreed with SecTrustGetCertificateCount().
Triage note: containsNonRootSHA1SignedCertificate() previously bounded the loop by SecTrustGetCertificateCount()-1 but indexed the separately-copied `chain` array and never null-checked it; the fix adds `if (!chain) return false` and bounds by CFArrayGetCount(chain)-1, aligning index source with the array actually read. Defensive hardening of a cert-validation path; counts are normally equal, so not clearly exploitable.
Triage note: containsNonRootSHA1SignedCertificate() previously bounded the loop by SecTrustGetCertificateCount()-1 but indexed the separately-copied `chain` array and never null-checked it; the fix adds `if (!chain) return false` and bounds by CFArrayGetCount(chain)-1, aligning index source with the array actually read. Defensive hardening of a cert-validation path; counts are normally equal, so not clearly exploitable.
Structural signals: null_guard (+1.95), msg_strong (+3.0), surgical (+1.3)
Commit message
CertificateInfo::containsNonRootSHA1SignedCertificate() bounds the certificate chain loop with a count from a separate SecTrust call
https://bugs.webkit.org/show_bug.cgi?id=324031
rdar://187261119
Reviewed by Chris Dumez.
containsNonRootSHA1SignedCertificate() indexed the certificate array
returned by SecTrustCopyCertificateChain() using a count obtained from a
separate SecTrustGetCertificateCount() call. Since the count and the
array came from two independent Security-framework calls, a mismatch
could index out of bounds. The result of SecTrustCopyCertificateChain()
was also never null-checked, and trust().get() was re-evaluated on every
loop iteration.
Derive the loop bound from CFArrayGetCount() on the same array being
indexed, null-check the copied chain, and evaluate the trust once.
* Source/WebCore/platform/network/cf/CertificateInfoCFNet.cpp:
(WebCore::CertificateInfo::containsNonRootSHA1SignedCertificate const):
Canonical link: https://commits.webkit.org/321001@main
Before / after
Loading diff…
On This Page