Skip to content

REGRESSION(308123@main): [GTK] Crash in Clipboard::formats() when pasting with an empty clipboard - #77266

Open
asxpi wants to merge 1 commit into
WebKit:mainfrom
asxpi:eng/REGRESSION-308123-main-GTK-Crash-in-Clipboard-formats-when-pasting-with-an-empty-clipboard
Open

asxpi wants to merge 1 commit into
WebKit:mainfrom
asxpi:eng/REGRESSION-308123-main-GTK-Crash-in-Clipboard-formats-when-pasting-with-an-empty-clipboard

Conversation

@asxpi

@asxpi asxpi commented Oct 16, 2026 •

Copy link
Copy Markdown

9cdf4a1

REGRESSION(308123@main): [GTK] Crash in Clipboard::formats() when pasting with an empty clipboard
https://bugs.webkit.org/show_bug.cgi?id=324466

Reviewed by NOBODY (OOPS!).

When the targets cannot be retrieved, for example when the clipboard has no
owner, GTK 3 calls the targets callback with atoms == nullptr and n_atoms ==
-1. The loop over the atoms ran zero times for that until 308123@main turned
it into a span, which takes -1 as a huge size over a null pointer: the UI
process crashed on every paste of an empty clipboard. Clamp the count to
zero, as readBuffer() already does for its length.

* Source/WebKit/UIProcess/gtk/ClipboardGtk3.cpp:
(WebKit::Clipboard::formats):

9cdf4a1

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ⏳ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ⏳ 🧪 api-mac-debug
⏳ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
loading 🛠 ios-safer-cpp ⏳ 🧪 mac-AS-debug-wk2 ✅ 🛠 gtk
✅ 🛠 vision ✅ 🧪 gtk-wk2
✅ 🛠 vision-sim ⏳ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp   🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@asxpi
asxpi requested a review from a team as a code owner October 16, 2026 11:28

@csaavedra csaavedra left a comment •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would consider keeping the shape of the original code but clamp the value to a minimum of zero to avoid the bug.

…ting with an empty clipboard

https://bugs.webkit.org/show_bug.cgi?id=324466

Reviewed by NOBODY (OOPS!).

When the targets cannot be retrieved, for example when the clipboard has no
owner, GTK 3 calls the targets callback with atoms == nullptr and n_atoms ==
-1. The loop over the atoms ran zero times for that until 308123@main turned
it into a span, which takes -1 as a huge size over a null pointer: the UI
process crashed on every paste of an empty clipboard. Clamp the count to
zero, as readBuffer() already does for its length.

* Source/WebKit/UIProcess/gtk/ClipboardGtk3.cpp:
(WebKit::Clipboard::formats):
@asxpi
asxpi force-pushed the eng/REGRESSION-308123-main-GTK-Crash-in-Clipboard-formats-when-pasting-with-an-empty-clipboard branch from e6b5e9f to 9cdf4a1 Compare October 16, 2026 12:30
@asxpi

asxpi commented Oct 16, 2026

Copy link
Copy Markdown
Author

I would consider keeping the shape of the original code but clamp the value to a minimum of zero to avoid the bug.

Thanks, done! The loop is unchanged now and the count is clamped with std::max(0, atomsCount), like readBuffer() does

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants