Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: dfe0d84a7b23319d997143cd24b33f9f1a0d51d9
https://github.com/WebKit/WebKit/commit/dfe0d84a7b23319d997143cd24b33f9f1a0d51d9
Author: Youenn Fablet <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
M Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp
M Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig
M
Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm
M Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
M Tools/TestWebKitAPI/Configurations/Base.xcconfig
M Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm
Log Message:
-----------
[WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010
frames
rdar://176978345
Reviewed by Jean-Yves Avenard.
copyVideoFrameBuffer used i420Frame->width() / i010Frame->width() as both the
destination row pitch and the UV plane size.
libyuv's I420ToNV12 / I010ToP010 round chroma dimensions up: they emit ((width
+ 1) / 2) * 2 bytes per UV row and (height + 1) / 2 UV rows.
For odd width, libyuv writes one byte (I420) or two bytes (I010) past each UV
row, with the final row's overrun landing past the end of the SharedMemory
mapping.
For odd height, an entire UV row's worth of data (~width or 2*width bytes)
lands past the mapping.
Round chroma dimensions up to match libyuv.
SharedVideoFrameInfo::fromVideoFrameBuffer now sizes the UV plane via
computeStrideUV<byteType>(frame) (sizeof(byteType) * (width rounded up to
even)) and computeHeightUV(frame) ((height + 1) / 2).
copyVideoFrameBuffer applies the same rounding to the strideUV it hands to
libyuv, so writer row pitch matches the receiver's m_bytesPerRowPlaneB and rows
no longer overlap.
Covered by added API tests.
* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp:
* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig:
*
Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm:
(webrtc::copyVideoFrameBuffer):
* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:
(WebCore::computeStrideY):
(WebCore::computeStrideUV):
(WebCore::computeWidthUV):
(WebCore::computeHeightUV):
(WebCore::SharedVideoFrameInfo::fromVideoFrameBuffer):
* Tools/TestWebKitAPI/Configurations/Base.xcconfig:
* Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig:
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm:
(TestWebKitAPI::TEST(SharedVideoFrame, PlaneAlphaSize)):
(TestWebKitAPI::testSharedVideoFrameInfoRoundTrip):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI420)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI420)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI420)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI010)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI010)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI010)):
(TestWebKitAPI::TEST(WebCore, SharedVideoFramePlaneAlphaSize)): Deleted.
Originally-landed-as: [email protected] (881cd542f818).
rdar://185368288
Canonical link: https://commits.webkit.org/319878@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
