webcrypto: reject oversized BufferSource inputs instead of aborting - #31356
Merged
Jarred-Sumner merged 4 commits intoMay 24, 2026
Merged
Claude / Claude Code Review
completed
May 24, 2026 in 43m 0s
Code review found 1 potential issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 1 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟣 Pre-existing | src/jsc/bindings/webcrypto/SubtleCrypto.cpp:561-567 |
Algorithm-parameter BufferSources still abort on oversized input |
Annotations
Check notice on line 567 in src/jsc/bindings/webcrypto/SubtleCrypto.cpp
claude / Claude Code Review
Algorithm-parameter BufferSources still abort on oversized input
This guards the top-level `data`/`signature`/`wrappedKey`/key-data arguments, but BufferSource members inside the algorithm dictionaries are still copied into `Vector<uint8_t>` unguarded — e.g. AES-GCM `additionalData`/`iv`, AES-CBC/CTR `iv`/`counter`, HKDF `salt`/`info`, PBKDF2 `salt`, RSA-OAEP `label`. `crypto.subtle.encrypt({name:'AES-GCM', iv, additionalData: new Uint8Array(2**31)}, key, small)` will still hit `Vector::allocateBuffer`'s `CRASH()` and abort the process. This is pre-existing (
Loading