LibWeb: Respect subarrays in Crypto#getRandomBytes

It is the responsibility of code that deals with TypedArrays to apply the byte offset and byte length. Not doing this caused Unity Web to crash, as they call getRandomValues with views into their full main memory. Previously, it would fill their entire memory of about 33.5 MB with random bytes.
LadybirdBrowser · Dec 10, 2024 · 023c3aa · 023c3aa
1 parent 30ec8c1
commit 023c3aa
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 1 deletion.
diff --git a/Libraries/LibWeb/Crypto/Crypto.cpp b/Libraries/LibWeb/Crypto/Crypto.cpp
@@ -67,7 +67,7 @@ WebIDL::ExceptionOr<GC::Root<WebIDL::ArrayBufferView>> Crypto::get_random_values
     // FIXME: Handle SharedArrayBuffers
 
     // 3. Overwrite all elements of array with cryptographically strong random values of the appropriate type.
-    fill_with_random(array->viewed_array_buffer()->buffer());
+    fill_with_random(array->viewed_array_buffer()->buffer().bytes().slice(array->byte_offset(), array->byte_length()));
 
     // 4. Return array.
     return array;

diff --git a/Tests/LibWeb/Text/expected/Crypto/Crypto-getRandomValues-respects-subarrays.txt b/Tests/LibWeb/Text/expected/Crypto/Crypto-getRandomValues-respects-subarrays.txt
@@ -0,0 +1,2 @@
+Is first 2 bytes still 0x41? true
+Is last 6 bytes still 0x41? true
diff --git a/Tests/LibWeb/Text/input/Crypto/Crypto-getRandomValues-respects-subarrays.html b/Tests/LibWeb/Text/input/Crypto/Crypto-getRandomValues-respects-subarrays.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        const array = new Uint8Array(16);
+        array.fill(0x41);
+        crypto.getRandomValues(new Uint8Array(array.buffer, 2, 8));
+        println(`Is first 2 bytes still 0x41? ${array.slice(0, 2).every(value => value === 0x41)}`);
+        println(`Is last 6 bytes still 0x41? ${array.slice(10).every(value => value === 0x41)}`);
+    });
+</script>
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Is first 2 bytes still 0x41? true
		Is last 6 bytes still 0x41? true