Title: [217692] trunk/Source/WebCore
- Revision
- 217692
- Author
- [email protected]
- Date
- 2017-06-01 19:50:50 -0700 (Thu, 01 Jun 2017)
Log Message
LibWebRTC might crash with frames having a null width or height
https://bugs.webkit.org/show_bug.cgi?id=172842
<rdar://problem/32514813>
Patch by Youenn Fablet <[email protected]> on 2017-06-01
Reviewed by Jon Lee.
Do not send black frames in case the video width or height is zero.
Also ensure that even if a null buffer is returned by the pool, no crash might actually happen.
* platform/mediastream/mac/RealtimeOutgoingVideoSource.cpp:
(WebCore::RealtimeOutgoingVideoSource::sendBlackFramesIfNeeded):
(WebCore::RealtimeOutgoingVideoSource::videoSampleAvailable):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (217691 => 217692)
--- trunk/Source/WebCore/ChangeLog 2017-06-02 02:44:45 UTC (rev 217691)
+++ trunk/Source/WebCore/ChangeLog 2017-06-02 02:50:50 UTC (rev 217692)
@@ -1,3 +1,18 @@
+2017-06-01 Youenn Fablet <[email protected]>
+
+ LibWebRTC might crash with frames having a null width or height
+ https://bugs.webkit.org/show_bug.cgi?id=172842
+ <rdar://problem/32514813>
+
+ Reviewed by Jon Lee.
+
+ Do not send black frames in case the video width or height is zero.
+ Also ensure that even if a null buffer is returned by the pool, no crash might actually happen.
+
+ * platform/mediastream/mac/RealtimeOutgoingVideoSource.cpp:
+ (WebCore::RealtimeOutgoingVideoSource::sendBlackFramesIfNeeded):
+ (WebCore::RealtimeOutgoingVideoSource::videoSampleAvailable):
+
2017-06-01 Devin Rousso <[email protected]>
Web Inspector: Should see active Web Sockets when opening Web Inspector
Modified: trunk/Source/WebCore/platform/mediastream/mac/RealtimeOutgoingVideoSource.cpp (217691 => 217692)
--- trunk/Source/WebCore/platform/mediastream/mac/RealtimeOutgoingVideoSource.cpp 2017-06-02 02:44:45 UTC (rev 217691)
+++ trunk/Source/WebCore/platform/mediastream/mac/RealtimeOutgoingVideoSource.cpp 2017-06-02 02:50:50 UTC (rev 217692)
@@ -161,6 +161,9 @@
if (!m_muted && m_enabled)
return;
+ if (!m_width || !m_height)
+ return;
+
if (!m_blackFrame) {
auto width = m_width;
auto height = m_height;
@@ -167,6 +170,11 @@
if (m_shouldApplyRotation && (m_currentRotation == webrtc::kVideoRotation_0 || m_currentRotation == webrtc::kVideoRotation_90))
std::swap(width, height);
auto frame = m_bufferPool.CreateBuffer(width, height);
+ ASSERT(frame);
+ if (!frame) {
+ RELEASE_LOG(WebRTC, "RealtimeOutgoingVideoSource::sendBlackFramesIfNeeded unable to send black frames");
+ return;
+ }
frame->SetToBlack();
m_blackFrame = WTFMove(frame);
}
@@ -235,7 +243,15 @@
CVPixelBufferLockBaseAddress(pixelBuffer, 0);
auto* source = reinterpret_cast<uint8_t*>(CVPixelBufferGetBaseAddressOfPlane(pixelBuffer, 0));
+ ASSERT(m_width);
+ ASSERT(m_height);
+
auto newBuffer = m_bufferPool.CreateBuffer(m_width, m_height);
+ ASSERT(newBuffer);
+ if (!newBuffer) {
+ RELEASE_LOG(WebRTC, "RealtimeOutgoingVideoSource::videoSampleAvailable unable to allocate buffer for conversion to YUV");
+ return;
+ }
if (pixelFormatType == kCVPixelFormatType_32BGRA)
webrtc::ConvertToI420(webrtc::kARGB, source, 0, 0, m_width, m_height, 0, webrtc::kVideoRotation_0, newBuffer);
else {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
