An off by one memory corruption issue exists in WebSocketHandshake::readServerHandshake(). This issue is addressed by improved bounds checking.

References:

Bugzilla: https://bugs.webkit.org/showbug.cgi?id=36339 Trac: http://trac.webkit.org/changeset/56380

Acknowledgements:

Red Hat would like to thank Drew Yao of Apple Product Security for responsibly reporting this issue. Upstream acknowledges Skylined of Google Chrome Security Team as the original reporter.