← WebKit — 2026-W37
9e61914f4c44e279bae69d437514c680be58a574 [JSC] Add more hint RELEASE_ASSERT etc. to remove assertion inside loop
severity medium
class OOB-write
confidence 0.4
signal score 10.17
Source/JavaScriptCore/runtime
Primitive: BigInt digit-buffer arithmetic (karatsuba/divideSchoolbook/shifts/spanCopy/createFrom) bounded by RELEASE_ASSERTs on span sizes.
Triage note: JSBigInt hardening pass: adds RELEASE_ASSERTs (y.size()<=z.size(), x.size()<=z.size()-y.size(), spanCopy z.size()>=x.size(), divideSchoolbook m/n window bounds), span/window refactors and createFrom(double) int32->size_t changes. Broad defensive hardening of attacker-reachable BigInt code, but the asserts largely prove existing invariants; no single concrete exploitable OOB demonstrably removed.
Triage note: JSBigInt hardening pass: adds RELEASE_ASSERTs (y.size()<=z.size(), x.size()<=z.size()-y.size(), spanCopy z.size()>=x.size(), divideSchoolbook m/n window bounds), span/window refactors and createFrom(double) int32->size_t changes. Broad defensive hardening of attacker-reachable BigInt code, but the asserts largely prove existing invariants; no single concrete exploitable OOB demonstrably removed.
Structural signals: security_assert (+6.47), null_guard (+1.2), area:Source/JavaScriptCore/runtime (+2.5)
Commit message
[JSC] Add more hint RELEASE_ASSERT etc. to remove assertion inside loop
https://bugs.webkit.org/show_bug.cgi?id=323899
rdar://187138408
Reviewed by Keith Miller.
A bit additional 320745@main work. Attaching RELEASE_ASSERT or modifying
span range to ensure that we are not emitting brk inside loop.
* Source/JavaScriptCore/runtime/JSBigInt.cpp:
(JSC::JSBigInt::createFrom):
(JSC::JSBigInt::karatsubaStart):
(JSC::spanCopy):
(JSC::JSBigInt::leftShift):
(JSC::JSBigInt::rightShift):
(JSC::JSBigInt::divideSchoolbook):
(JSC::JSBigInt::cachedModMakeInverse):
(JSC::JSBigInt::toStringGeneric):
(JSC::JSBigInt::truncateToNBits):
Canonical link: https://commits.webkit.org/320976@main
Before / after
Loading diff…
On This Page