Skip to content

Commit

Permalink
Cherry-pick 272448.816@safari-7618-branch (63e5787). https://bugs.web…
Browse files Browse the repository at this point in the history 
…kit.org/show_bug.cgi?id=271741

    Add IPC validation for `WebCore::Region::Shape`
    https://bugs.webkit.org/show_bug.cgi?id=271741
    rdar://125348548

    Reviewed by Matt Woodrow.

    * LayoutTests/ipc/dirty-region-overflow-expected.txt: Added.
    * LayoutTests/ipc/dirty-region-overflow.html: Added.
    * Source/WebCore/platform/graphics/Region.cpp:
    (WebCore::Region::Shape::isValid const):
    * Source/WebCore/platform/graphics/Region.h:
    * Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:

    Canonical link: https://commits.webkit.org/272448.816@safari-7618-branch

Canonical link: https://commits.webkit.org/274313.242@webkitglib/2.44
  • Loading branch information
@charliewolfe @aperezdc
charliewolfe authored and aperezdc committed May 13, 2024
1 parent 9b1e21b commit 605bed7
Show file tree
Hide file tree
Showing 5 changed files with 37 additions and 1 deletion.
1 change: 1 addition & 0 deletions LayoutTests/ipc/dirty-region-overflow-expected.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
This test passes if it does not crash.
24 changes: 24 additions & 0 deletions LayoutTests/ipc/dirty-region-overflow.html
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<!DOCTYPE html><!-- webkit-test-runner [ IPCTestingAPIEnabled=true ] -->
<head>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
function test() {
if (window.IPC) {
pair = IPC.createStreamClientConnection(14);
connection = pair[0];
connection.open();
IPC.sendMessage('GPU', 0, IPC.messages.GPUConnectionToWebProcess_CreateRenderingBackend.name, [{ type: 'uint64_t', value: 720 }, { type: 'uint64_t', value: IPC.webPageProxyID }, { type: 'uint64_t', value: IPC.pageID }, { type: 'StreamServerConnectionHandle', value: pair[1] }]);
connection.sendMessage(720, IPC.messages.RemoteRenderingBackend_CreateRemoteImageBufferSet.name, 0.1, [{ type: 'uint64_t', value: 923 }, { type: 'uint64_t', value: 942 }]);
connection.sendMessage(923, IPC.messages.RemoteImageBufferSet_UpdateConfiguration.name, 0.1, [{ type: 'float', value: 3 }, { type: 'float', value: 565.27 }, { type: 'uint8_t', value: 1 }, { type: 'float', value: 212 }, { type: 'uint32_t', value: 2 }, { type: 'uint8_t', value: 246 }]);
connection.sendMessage(720, IPC.messages.RemoteRenderingBackend_PrepareImageBufferSetsForDisplay.name, 0.1, [{ type: 'Vector', value: [[{ type: 'uint64_t', value: 923 }, { type: 'uint32_t', value: 1 }, { type: 'uint32_t', value: 28 }, { type: 'uint32_t', value: 26 }, { type: 'uint32_t', value: 1 }, { type: 'bool', value: 1 }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 19 }], [{ type: 'uint32_t', value: 676 }], [{ type: 'uint32_t', value: 654208003 }], [{ type: 'uint32_t', value: 28 }], [{ type: 'uint32_t', value: 26 }], [{ type: 'uint32_t', value: 2258492644 }], [{ type: 'uint32_t', value: 25 }], [{ type: 'uint32_t', value: 3983044464 }], [{ type: 'uint32_t', value: 227 }], [{ type: 'uint32_t', value: 1031381070 }], [{ type: 'uint32_t', value: 2136240 }], [{ type: 'uint32_t', value: 24 }], [{ type: 'uint32_t', value: 24 }], [{ type: 'uint32_t', value: 13 }], [{ type: 'uint32_t', value: 0 }], [{ type: 'uint32_t', value: 213 }], [{ type: 'uint32_t', value: 14 }], [{ type: 'uint32_t', value: 3 }], [{ type: 'uint32_t', value: 579888162 }], [{ type: 'uint32_t', value: 3 }], [{ type: 'uint32_t', value: 24 }], [{ type: 'uint32_t', value: 24 }], [{ type: 'uint32_t', value: 424 }], [{ type: 'uint32_t', value: 8 }], [{ type: 'uint32_t', value: 29 }], [{ type: 'uint32_t', value: 5 }], [{ type: 'uint32_t', value: 952724494 }], [{ type: 'uint32_t', value: 4 }], [{ type: 'uint32_t', value: 7 }], [{ type: 'uint32_t', value: 9 }], [{ type: 'uint32_t', value: 30 }], [{ type: 'uint32_t', value: 1006 }], [{ type: 'uint32_t', value: 916 }], [{ type: 'uint32_t', value: 476 }], [{ type: 'uint32_t', value: 4 }], [{ type: 'uint32_t', value: 30 }], [{ type: 'uint32_t', value: 5 }], [{ type: 'uint32_t', value: 3 }], [{ type: 'uint32_t', value: 18 }], [{ type: 'uint32_t', value: 15 }], [{ type: 'uint32_t', value: 21 }], [{ type: 'uint32_t', value: 25 }], [{ type: 'uint32_t', value: 15 }], [{ type: 'uint32_t', value: 19 }], [{ type: 'uint32_t', value: 1002 }], [{ type: 'uint32_t', value: 1294402999 }], [{ type: 'uint32_t', value: 29 }], [{ type: 'uint32_t', value: 10 }], [{ type: 'uint32_t', value: 28 }], [{ type: 'uint32_t', value: 12 }], [{ type: 'uint32_t', value: 17 }], [{ type: 'uint32_t', value: 26 }], [{ type: 'uint32_t', value: 567 }], [{ type: 'uint32_t', value: 26 }], [{ type: 'uint32_t', value: 13 }], [{ type: 'uint32_t', value: 31 }], [{ type: 'uint32_t', value: 966 }], [{ type: 'uint32_t', value: 12 }], [{ type: 'uint32_t', value: 20 }], [{ type: 'uint32_t', value: 31 }], [{ type: 'uint32_t', value: 23 }], [{ type: 'uint32_t', value: 475 }], [{ type: 'uint32_t', value: 20 }], [{ type: 'uint32_t', value: 26 }], [{ type: 'uint32_t', value: 28 }], [{ type: 'uint32_t', value: 3937739 }], [{ type: 'uint32_t', value: 29 }], [{ type: 'uint32_t', value: 37 }], [{ type: 'uint32_t', value: 785 }], [{ type: 'uint32_t', value: 31 }], [{ type: 'uint32_t', value: 12 }], [{ type: 'uint32_t', value: 4 }], [{ type: 'uint32_t', value: 30 }]] }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 6 }, { type: 'uint64_t', value: 25 }], [{ type: 'uint32_t', value: 14 }, { type: 'uint64_t', value: 22 }], [{ type: 'uint32_t', value: 0 }, { type: 'uint64_t', value: 292 }], [{ type: 'uint32_t', value: 368 }, { type: 'uint64_t', value: 316 }], [{ type: 'uint32_t', value: 18 }, { type: 'uint64_t', value: 50 }], [{ type: 'uint32_t', value: 31 }, { type: 'uint64_t', value: 20 }], [{ type: 'uint32_t', value: 867 }, { type: 'uint64_t', value: 123 }], [{ type: 'uint32_t', value: 9 }, { type: 'uint64_t', value: 8 }], [{ type: 'uint32_t', value: 23 }, { type: 'uint64_t', value: 566 }]] }, { type: 'bool', value: 1 }, { type: 'bool', value: 1 }, { type: 'bool', value: 0 }], [{ type: 'uint64_t', value: 1559 }, { type: 'uint32_t', value: 894 }, { type: 'uint32_t', value: 12 }, { type: 'uint32_t', value: 22 }, { type: 'uint32_t', value: 81 }, { type: 'bool', value: 1 }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 31 }], [{ type: 'uint32_t', value: 17 }], [{ type: 'uint32_t', value: 24 }], [{ type: 'uint32_t', value: 766 }], [{ type: 'uint32_t', value: 8 }], [{ type: 'uint32_t', value: 18 }], [{ type: 'uint32_t', value: 9 }], [{ type: 'uint32_t', value: 914 }], [{ type: 'uint32_t', value: 10 }]] }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 560 }, { type: 'uint64_t', value: 213 }], [{ type: 'uint32_t', value: 308 }, { type: 'uint64_t', value: 14 }], [{ type: 'uint32_t', value: 9 }, { type: 'uint64_t', value: 5828760 }], [{ type: 'uint32_t', value: 29 }, { type: 'uint64_t', value: 2097182 }], [{ type: 'uint32_t', value: 23 }, { type: 'uint64_t', value: 1 }], [{ type: 'uint32_t', value: 8 }, { type: 'uint64_t', value: 26 }], [{ type: 'uint32_t', value: 967 }, { type: 'uint64_t', value: 2080374815 }], [{ type: 'uint32_t', value: 25 }, { type: 'uint64_t', value: 69 }], [{ type: 'uint32_t', value: 28 }, { type: 'uint64_t', value: 4 }], [{ type: 'uint32_t', value: 5 }, { type: 'uint64_t', value: 1 }], [{ type: 'uint32_t', value: 1003 }, { type: 'uint64_t', value: 4 }]] }, { type: 'bool', value: 0 }, { type: 'bool', value: 1 }, { type: 'bool', value: 1 }], [{ type: 'uint64_t', value: 923 }, { type: 'uint32_t', value: 8041036 }, { type: 'uint32_t', value: 627 }, { type: 'uint32_t', value: 1 }, { type: 'uint32_t', value: 3 }, { type: 'bool', value: 1 }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 21 }], [{ type: 'uint32_t', value: 2 }]] }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 6 }, { type: 'uint64_t', value: -2147483648 }], [{ type: 'uint32_t', value: 376 }, { type: 'uint64_t', value: 26 }], [{ type: 'uint32_t', value: 1 }, { type: 'uint64_t', value: 21 }], [{ type: 'uint32_t', value: 62 }, { type: 'uint64_t', value: 74 }], [{ type: 'uint32_t', value: 829 }, { type: 'uint64_t', value: 4 }], [{ type: 'uint32_t', value: 29 }, { type: 'uint64_t', value: 1 }], [{ type: 'uint32_t', value: 13 }, { type: 'uint64_t', value: 856 }], [{ type: 'uint32_t', value: 968 }, { type: 'uint64_t', value: 29 }], [{ type: 'uint32_t', value: 26 }, { type: 'uint64_t', value: 24 }], [{ type: 'uint32_t', value: 451 }, { type: 'uint64_t', value: 507 }]] }, { type: 'bool', value: 0 }, { type: 'bool', value: 1 }, { type: 'bool', value: 1 }], [{ type: 'uint64_t', value: 1559 }, { type: 'uint32_t', value: 14 }, { type: 'uint32_t', value: 852 }, { type: 'uint32_t', value: 536 }, { type: 'uint32_t', value: 1 }, { type: 'bool', value: 1 }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 8 }], [{ type: 'uint32_t', value: 22 }], [{ type: 'uint32_t', value: 23 }], [{ type: 'uint32_t', value: 20 }]] }, { type: 'Vector', value: [] }, { type: 'bool', value: 1 }, { type: 'bool', value: 0 }, { type: 'bool', value: 0 }], [{ type: 'uint64_t', value: 1559 }, { type: 'uint32_t', value: 202048 }, { type: 'uint32_t', value: 21 }, { type: 'uint32_t', value: 17 }, { type: 'uint32_t', value: 30 }, { type: 'bool', value: 1 }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 2 }], [{ type: 'uint32_t', value: 4 }], [{ type: 'uint32_t', value: 77 }], [{ type: 'uint32_t', value: 12 }], [{ type: 'uint32_t', value: 27 }], [{ type: 'uint32_t', value: 290 }], [{ type: 'uint32_t', value: 25 }], [{ type: 'uint32_t', value: 740 }], [{ type: 'uint32_t', value: 18 }], [{ type: 'uint32_t', value: 20 }], [{ type: 'uint32_t', value: 12 }], [{ type: 'uint32_t', value: 29 }]] }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 22 }, { type: 'uint64_t', value: 0 }], [{ type: 'uint32_t', value: 29 }, { type: 'uint64_t', value: 28 }], [{ type: 'uint32_t', value: 1 }, { type: 'uint64_t', value: 747 }], [{ type: 'uint32_t', value: 7 }, { type: 'uint64_t', value: 12 }], [{ type: 'uint32_t', value: 12 }, { type: 'uint64_t', value: 23 }], [{ type: 'uint32_t', value: 6 }, { type: 'uint64_t', value: 24 }], [{ type: 'uint32_t', value: 934 }, { type: 'uint64_t', value: 1682551 }], [{ type: 'uint32_t', value: 10 }, { type: 'uint64_t', value: 21 }], [{ type: 'uint32_t', value: 31 }, { type: 'uint64_t', value: 6 }], [{ type: 'uint32_t', value: 20 }, { type: 'uint64_t', value: 1 }], [{ type: 'uint32_t', value: 17 }, { type: 'uint64_t', value: 15 }]] }, { type: 'bool', value: 1 }, { type: 'bool', value: 1 }, { type: 'bool', value: 0 }], [{ type: 'uint64_t', value: 1559 }, { type: 'uint32_t', value: 27 }, { type: 'uint32_t', value: 7 }, { type: 'uint32_t', value: 14 }, { type: 'uint32_t', value: 2 }, { type: 'bool', value: 1 }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 11 }], [{ type: 'uint32_t', value: 30 }], [{ type: 'uint32_t', value: 21 }], [{ type: 'uint32_t', value: 25 }], [{ type: 'uint32_t', value: 30 }], [{ type: 'uint32_t', value: 17 }], [{ type: 'uint32_t', value: 6 }], [{ type: 'uint32_t', value: 31 }], [{ type: 'uint32_t', value: 30 }], [{ type: 'uint32_t', value: 511 }], [{ type: 'uint32_t', value: 8 }]] }, { type: 'Vector', value: [[{ type: 'uint32_t', value: 21 }, { type: 'uint64_t', value: 4242 }], [{ type: 'uint32_t', value: 14 }, { type: 'uint64_t', value: 14 }], [{ type: 'uint32_t', value: 26 }, { type: 'uint64_t', value: 24 }], [{ type: 'uint32_t', value: 12 }, { type: 'uint64_t', value: 22 }], [{ type: 'uint32_t', value: 12 }, { type: 'uint64_t', value: 6 }], [{ type: 'uint32_t', value: 331 }, { type: 'uint64_t', value: 29 }], [{ type: 'uint32_t', value: 43 }, { type: 'uint64_t', value: 20 }], [{ type: 'uint32_t', value: 23 }, { type: 'uint64_t', value: 15 }], [{ type: 'uint32_t', value: 2 }, { type: 'uint64_t', value: 1 }], [{ type: 'uint32_t', value: 2 }, { type: 'uint64_t', value: 22 }], [{ type: 'uint32_t', value: 25 }, { type: 'uint64_t', value: 31 }], [{ type: 'uint32_t', value: 50 }, { type: 'uint64_t', value: 835 }], [{ type: 'uint32_t', value: 25 }, { type: 'uint64_t', value: 7657 }], [{ type: 'uint32_t', value: 15 }, { type: 'uint64_t', value: 1325891674 }], [{ type: 'uint32_t', value: 10 }, { type: 'uint64_t', value: 20 }]] }, { type: 'bool', value: 1 }, { type: 'bool', value: 0 }, { type: 'bool', value: 0 }]] }]);
}
setTimeout(testRunner.notifyDone(), 500);
}
</script>
</head>
<body onload='test()'>
<p>This test passes if it does not crash.</p>
</body>
9 changes: 9 additions & 0 deletions Source/WebCore/platform/graphics/Region.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -667,6 +667,15 @@ void Region::setShape(Shape&& shape)
*m_shape = WTFMove(shape);
}

bool Region::Shape::isValid() const
{
for (auto span = spans_begin(), end = spans_end(); span != end; ++span) {
if (UNLIKELY(span->segmentIndex > m_segments.size()))
return false;
}
return true;
}

TextStream& operator<<(TextStream& ts, const Region& region)
{
ts << "\n";
Expand Down
2 changes: 2 additions & 0 deletions Source/WebCore/platform/graphics/Region.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,8 @@ class Region {
template<typename CompareOperation>
static bool compareShapes(const Shape& shape1, const Shape& shape2);

WEBCORE_EXPORT bool isValid() const;

#ifndef NDEBUG
void dump() const;
#endif
Expand Down
2 changes: 1 addition & 1 deletion Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5763,7 +5763,7 @@ struct WebCore::InteractionRegion {

[AdditionalEncoder=StreamConnectionEncoder] class WebCore::Region {
WebCore::IntRect bounds();
std::unique_ptr<WebCore::Region::Shape> copyShape();
[Validator='!*copyShape || (*copyShape)->isValid()'] std::unique_ptr<WebCore::Region::Shape> copyShape();
}

header: <WebCore/ISOVTTCue.h>
Expand Down

0 comments on commit 605bed7

Please sign in to comment.