[Webkit-unassigned] [Bug 224840] Crash due to VectorBuffer pre-allocation failure
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Apr 20 17:42:25 PDT 2021
https://bugs.webkit.org/show_bug.cgi?id=224840
Sam Weinig <sam at webkit.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |sam at webkit.org
Attachment #426614|review? |review+
Flags| |
--- Comment #4 from Sam Weinig <sam at webkit.org> ---
Comment on attachment 426614
--> https://bugs.webkit.org/attachment.cgi?id=426614
Patch
I don't quite know how to review the test, but the change looks good.
I think there might be a similar issue in:
ArgumentCoder<WebCore::CDMInstanceSession::KeyStatusVector>::decode(...)
which does a `keyStatuses.reserveInitialCapacity(dataSize);` from a decoded size.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210421/5880bede/attachment-0001.htm>
More information about the webkit-unassigned
mailing list