← WebKit — 2026-W38
57fe702497349c44e516699e352e1fa3ea146036 CDMInstanceSessionFairPlayStreamingAVFObjC::didProvideRenewingRequest() dereferences empty keyIDs vector
severity medium
class OOB-read
confidence 0.6
signal score 6.5
Source/WebCore/platform
patch-now
Primitive: Vector::first() on an empty keyIDs list in FairPlay license update
Triage note: CDMInstanceFairPlayStreamingAVFObjC adds an early return when keyIDsForRequest(m_currentRequest) yields no keyIDs, before the subsequent keyIDs.first() dereference; without it an empty key-ID list (from a malformed license response) reaches first() on an empty Vector (out-of-bounds/release-assert crash).
Triage note: CDMInstanceFairPlayStreamingAVFObjC adds an early return when keyIDsForRequest(m_currentRequest) yields no keyIDs, before the subsequent keyIDs.first() dereference; without it an empty key-ID list (from a malformed license response) reaches first() on an empty Vector (out-of-bounds/release-assert crash).
Structural signals: null_guard (+1.2), msg_strong (+3.0), msg_soft (+1.0), surgical (+1.3)
Commit message
CDMInstanceSessionFairPlayStreamingAVFObjC::didProvideRenewingRequest() dereferences empty keyIDs vector
https://bugs.webkit.org/show_bug.cgi?id=324304
rdar://187533371
Reviewed by Jean-Yves Avenard.
didProvideRenewingRequest() calls keyIDs.first() to build the content
identifier without first checking whether keyIDsForRequest() returned an
empty vector, unlike every sibling path that follows the same pattern:
didProvideRequest() guards with keyIDs.isEmpty() before its .first() call,
and updateLicense() does the same. The keyIDs are derived from the
AVContentKeyRequest identifier supplied by AVFoundation, which can be
empty, so first() on an empty Vector is an out-of-bounds access.
Add the same isEmpty() guard used by didProvideRequest()/updateLicense(),
failing the update through m_updateLicenseCallback (matching this
function's existing @catch handler) before dereferencing.
This path is only reachable through a live FairPlay Streaming license
renewal driven by AVFoundation and is not exercisable from layout tests
(which use the mock CDM) or API tests, so no test accompanies this
defensive fix.
* Source/WebCore/platform/graphics/avfoundation/objc/CDMInstanceFairPlayStreamingAVFObjC.mm:
(WebCore::CDMInstanceSessionFairPlayStreamingAVFObjC::didProvideRenewingRequest):
Canonical link: https://commits.webkit.org/321453@main
Before / after
Loading diff…
On This Page