9ffd3e48c3
Problem: Crash when generating an RSA key — or serializing one — whose publicExponent is a typed array whose backing ArrayBuffer has been detached; for example, by calling transfer() on it. Cause: Two places with big_integer_from_api_big_integer() reading the bytes of the backing ArrayBuffer directly. But reading the bytes of a detached buffer aborts. Fix: Read the bytes with WebIDL get_buffer_source_copy() — which yields an empty copy for a detached, or OOB resizable, buffer. The empty array is already mapped to zero — so generation rejects the zero exponent with an error, rather than crashing. Fixes https://github.com/LadybirdBrowser/ladybird/issues/9991
22 lines
762 B
HTML
22 lines
762 B
HTML
<!DOCTYPE html>
|
|
<script src="../include.js"></script>
|
|
<script>
|
|
asyncTest(async done => {
|
|
const keyPair = await crypto.subtle.generateKey({
|
|
name: "RSASSA-PKCS1-v1_5",
|
|
modulusLength: 1024,
|
|
publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
|
|
hash: "SHA-256",
|
|
}, true, ["sign", "verify"]);
|
|
|
|
// Detach the buffer backing the stored publicExponent, then serialize the key by cloning it.
|
|
keyPair.publicKey.algorithm.publicExponent.buffer.transfer();
|
|
try {
|
|
structuredClone(keyPair.publicKey);
|
|
println("PASS (didn't crash): cloned");
|
|
} catch (e) {
|
|
println("PASS (didn't crash): " + e.name);
|
|
}
|
|
done();
|
|
});
|
|
</script>
|