mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-07-19 07:22:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb/HTML: Avoid potential overflow of index for DOMStringList

Browse source 
The included WPT test passes through -1 which ends up modolo'ing
to u32 max at the IDL conversion layer, resulting in an unsigned
overflow when checking bounds.
This commit is contained in:
Shannon Booth 2025-07-05 22:11:47 +12:00 • committed by Tim Ledbetter
parent 715061fb79
commit 1b8a77f98c
Notes: github-actions[bot] 2025-07-05 11:29:35 +00:00
3 changed files with 72 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Libraries/LibWeb/HTML/DOMStringList.cpp
View file

@ -43,7 +43,7 @@ Optional<String> DOMStringList::item(u32 index) const
{
// The item(index) method steps are to return the indexth item in this's associated list, or null if index plus one
// is greater than this's associated list's size.
if (index + 1 > m_list.size())
if (index >= m_list.size())
return {};
return m_list.at(index);
@ -58,7 +58,7 @@ bool DOMStringList::contains(StringView string)
Optional<JS::Value> DOMStringList::item_value(size_t index) const
{
if (index + 1 > m_list.size())
if (index >= m_list.size())
return {};
return JS::PrimitiveString::create(vm(), m_list.at(index));