[20] [WebCore] Fix INT32_MIN UB in BackForwardController distance arithmetic

Severity: Low | Component: WebKit UIProcess back/forward navigation | a6cd3ca

Rated Low because the diff hardens the INT32_MIN arithmetic path in BackForwardController::canGoBackOrForward and WebBackForwardList::itemAtDeltaFromCurrentIndex; pre-fix, static_cast<unsigned>(-distance) is UB at INT32_MIN and may bypass the underflow guard, but the downstream effect is bounded by the back-forward list array indexing and does not yield a controlled memory primitive.

The signed negation is replaced with safe widened arithmetic; delta/distance is computed in a wider type or guarded against INT32_MIN before negation.

Source/WebCore/history/BackForwardController.cpp

- return static_cast<unsigned>(-distance) <= backCount();

+ return distance != std::numeric_limits<int>::min() && static_cast<unsigned>(-distance) <= backCount();

Signed integer overflow in an underflow guard that is itself exposed to attacker-supplied INT32_MIN via the backForwardItemAtIndexForWebContent IPC.

Patch Details

The negation is guarded for INT32_MIN. The same change is applied in WebBackForwardList::itemAtDeltaFromCurrentIndex.

Background

backForwardItemAtIndexForWebContent is an IPC handler in the UI process. The WebContent process sends a delta from the current index; the handler walks the back/forward stack.

Analysis

Pre-fix, the negative-distance branch performed the negation in signed arithmetic: static_cast<unsigned>(-distance) evaluates -distance as int first, then casts. With distance == INT32_MIN, -INT32_MIN is not representable as positive int — signed integer overflow, UB.

The compiler is permitted to assume signed overflow does not occur, so the bounds guard may be optimized away. On two's-complement architectures the negation wraps back to INT32_MIN, which after cast becomes 0x80000000 (≈ 2.1 billion). The value can falsely satisfy or fail the bounds check depending on backCount() / m_currentIndex. The primitive is an out-of-bounds array read against the back/forward stack — the consumers index a WebBackForwardListItem vector.

This weakens an IPC-reachable bounds check in the UI process.

Audit directions

Every IPC entry point that accepts a signed delta for similar INT32_MIN negation patterns. Grep static_cast<unsigned>(- in IPC receivers.
Bounded-arithmetic helpers in the UI process that compute on attacker-controlled signed integers.
CheckedArithmetic adoption at the IPC boundary — every signed delta receiver is a candidate.