Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c18f11b0d1e989215dbd05221e763ef6c0208fc9
https://github.com/WebKit/WebKit/commit/c18f11b0d1e989215dbd05221e763ef6c0208fc9
Author: Youenn Fablet <[email protected]>
Date: 2026-08-27 (Thu, 27 Aug 2026)
Changed paths:
M Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp
M Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig
M
Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm
M Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
M Tools/TestWebKitAPI/Configurations/Base.xcconfig
M Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm
Log Message:
-----------
[WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010
frames
<https://bugs.webkit.org/show_bug.cgi?id=322761>
<rdar://176978345>
Reviewed by Jean-Yves Avenard.
copyVideoFrameBuffer used i420Frame->width() / i010Frame->width() as both the
destination row pitch and the UV plane size.
libyuv's I420ToNV12 / I010ToP010 round chroma dimensions up: they emit ((width
+ 1) / 2) * 2 bytes per UV row and (height + 1) / 2 UV rows.
For odd width, libyuv writes one byte (I420) or two bytes (I010) past each UV
row, with the final row's overrun landing past the end of the SharedMemory
mapping.
For odd height, an entire UV row's worth of data (~width or 2*width bytes)
lands past the mapping.
Round chroma dimensions up to match libyuv.
SharedVideoFrameInfo::fromVideoFrameBuffer now sizes the UV plane via
computeStrideUV<byteType>(frame) (sizeof(byteType) * (width rounded up to
even)) and computeHeightUV(frame) ((height + 1) / 2).
copyVideoFrameBuffer applies the same rounding to the strideUV it hands to
libyuv, so writer row pitch matches the receiver's m_bytesPerRowPlaneB and rows
no longer overlap.
Re-land 319878@main, reverted by 319927@main for breaking ASan builds.
The added tests make TestWebKitAPI a libwebrtc client, but its
Configurations/Base.xcconfig searched neither the webrtc header
directory nor the directory libwebrtc.dylib installs into, so the
build failed first at `api/scoped_refptr.h` and then at `-lwebrtc`.
Give it both search paths, so it resolves libwebrtc the same way
WebCore.xcconfig and WebKit.xcconfig already do.
Covered by added API tests.
* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp:
* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig:
*
Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm:
(webrtc::copyVideoFrameBuffer):
* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:
(WebCore::computeStrideY):
(WebCore::computeStrideUV):
(WebCore::computeWidthUV):
(WebCore::computeHeightUV):
(WebCore::SharedVideoFrameInfo::fromVideoFrameBuffer):
* Tools/TestWebKitAPI/Configurations/Base.xcconfig:
* Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig:
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm:
(TestWebKitAPI::TEST(SharedVideoFrame, PlaneAlphaSize)):
(TestWebKitAPI::testSharedVideoFrameInfoRoundTrip):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI420)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI420)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI420)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI010)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI010)):
(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI010)):
(TestWebKitAPI::TEST(WebCore, SharedVideoFramePlaneAlphaSize)): Deleted.
Originally-landed-as: [email protected] (881cd542f818).
rdar://185368288
Canonical link: https://commits.webkit.org/320009@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
