mirrors/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-04-21 03:55:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb: Respect subarrays in Crypto#getRandomBytes

Browse source 
It is the responsibility of code that deals with TypedArrays to apply
the byte offset and byte length. Not doing this caused Unity Web to
crash, as they call getRandomValues with views into their full main
memory. Previously, it would fill their entire memory of about 33.5 MB
with random bytes.
This commit is contained in:
Luke Wilde 2024-12-09 22:04:12 +00:00 • committed by Tim Flynn
parent 30ec8c1d4d
commit 023c3aa5b0
Notes: github-actions[bot] 2024-12-10 14:44:56 +00:00
3 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibWeb/Crypto/Crypto.cpp
View file

@ -67,7 +67,7 @@ WebIDL::ExceptionOr<GC::Root<WebIDL::ArrayBufferView>> Crypto::get_random_values
// FIXME: Handle SharedArrayBuffers
// 3. Overwrite all elements of array with cryptographically strong random values of the appropriate type.
fill_with_random(array->viewed_array_buffer()->buffer());
fill_with_random(array->viewed_array_buffer()->buffer().bytes().slice(array->byte_offset(), array->byte_length()));
// 4. Return array.
return array;

2
Tests/LibWeb/Text/expected/Crypto/Crypto-getRandomValues-respects-subarrays.txt Normal file
View file

@ -0,0 +1,2 @@
Is first 2 bytes still 0x41? true
Is last 6 bytes still 0x41? true

11
Tests/LibWeb/Text/input/Crypto/Crypto-getRandomValues-respects-subarrays.html Normal file
View file

@ -0,0 +1,11 @@
<!DOCTYPE html>
<script src="../include.js"></script>
<script>
test(() => {
const array = new Uint8Array(16);
array.fill(0x41);
crypto.getRandomValues(new Uint8Array(array.buffer, 2, 8));
println(`Is first 2 bytes still 0x41? ${array.slice(0, 2).every(value => value === 0x41)}`);
println(`Is last 6 bytes still 0x41? ${array.slice(10).every(value => value === 0x41)}`);
});
</script>