← All issues

[14] WebCrypto EC SPKI/PKCS8 importer bounds check

Severity: High | Component: WebCore Web Crypto | d3de21e

Rated High because the diff fixes a renderer-reachable parser bug: a 0xFF length byte advances the parse cursor 128 bytes past the buffer end, causing unsigned underflow on keyData.size() - index (SPKI) or an OOB subvector(index) that trips RELEASE_ASSERT (PKCS8 crash).

CryptoKeyEC::platformImportSpki and platformImportPkcs8 advanced index by bytesUsedToEncodedLength(keyData[index]) + 1 without a bounds check. A long-form length byte returns up to 128, pushing index well past keyData.size().

Source/WebCore/crypto/cocoa/CryptoKeyECCocoa.cpp

index += 1; // Read BIT STRING
+ if (index + bytesUsedToEncodedLength(keyData[index]) + 1 > keyData.size())
+ return nullptr;
index += bytesUsedToEncodedLength(keyData[index]) + 1;
auto keySize = keyData.size() - index;

Bounds checks gate the cursor advance in both importers. Six new EC LayoutTests mirror existing RSA tests one-for-one.

Missing post-advance bounds check on an attacker-controlled ASN.1 length byte that can advance the parse cursor past the buffer end.

SubtleCrypto.importKey accepts SPKI (SubjectPublicKeyInfo) or PKCS8 (PrivateKeyInfo) bytes. ASN.1 DER length encoding: a byte < 0x80 encodes length directly; ≥ 0x80 encodes the number of subsequent bytes that form the length (0xFF means 127 extra bytes, so the length field itself can consume up to 128 bytes). bytesUsedToEncodedLength(b) returns the bytes the length field occupies. Vector<uint8_t>::subvector(offset) RELEASE_ASSERTs offset <= size().

The commit message says it explicitly: same bug fixed for RSA in 308706@main. EC was simply missed.

🔒

How a single malformed length byte in a `crypto.subtle.importKey` call drives the parse cursor off the end of the buffer — and what the two diverging consequences mean for the renderer.

Subscribe to read more

🔒

Multiple reusable audit patterns identified across WebKit's ASN.1 / DER parsers, with concrete starting points for variant discovery in sibling-algorithm key importers.

Subscribe to read more