Title: [259661] branches/safari-609.2.1.2-branch/Source/WebKit
- Revision
- 259661
- Author
- [email protected]
- Date
- 2020-04-07 13:03:10 -0700 (Tue, 07 Apr 2020)
Log Message
Apply patch. rdar://problem/61404555
Modified Paths
Diff
Modified: branches/safari-609.2.1.2-branch/Source/WebKit/ChangeLog (259660 => 259661)
--- branches/safari-609.2.1.2-branch/Source/WebKit/ChangeLog 2020-04-07 19:59:24 UTC (rev 259660)
+++ branches/safari-609.2.1.2-branch/Source/WebKit/ChangeLog 2020-04-07 20:03:10 UTC (rev 259661)
@@ -1,3 +1,27 @@
+2020-04-07 Alan Coon <[email protected]>
+
+ Apply patch. rdar://problem/61404555
+
+ 2020-04-07 David Kilzer <[email protected]>
+
+ Cherry-pick r258053. rdar://problem/60430195
+
+ 2020-03-06 David Kilzer <[email protected]>
+
+ IPC hardening for WebPageProxy::SaveImageToLibrary message
+ <https://webkit.org/b/208730>
+ <rdar://problem/58700693>
+
+ Reviewed by Chris Dumez.
+
+ * UIProcess/ios/WebPageProxyIOS.mm:
+ (MESSAGE_CHECK): Define macro only for methods in this source file.
+ (WebKit::WebPageProxy::saveImageToLibrary):
+ - Make sure the shared memory handle sent over IPC is not null.
+ - Make sure the image size sent over IPC is not zero.
+ - Null check the SharedMemory object after calling
+ SharedMemory::map().
+
2020-04-03 Alan Coon <[email protected]>
Cherry-pick r259056. rdar://problem/61231908
Modified: branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm (259660 => 259661)
--- branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm 2020-04-07 19:59:24 UTC (rev 259660)
+++ branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm 2020-04-07 20:03:10 UTC (rev 259661)
@@ -76,6 +76,8 @@
#import <wtf/text/WTFString.h>
#endif
+#define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, process().connection())
+
#define RELEASE_LOG_IF_ALLOWED(channel, fmt, ...) RELEASE_LOG_IF(isAlwaysOnLoggingAllowed(), channel, "%p - [pageProxyID=%llu, webPageID=%llu, PID=%i] WebPageProxy::" fmt, this, m_identifier.toUInt64(), m_webPageID.toUInt64(), m_process->processIdentifier(), ##__VA_ARGS__)
namespace WebKit {
@@ -644,7 +646,13 @@
void WebPageProxy::saveImageToLibrary(const SharedMemory::Handle& imageHandle, uint64_t imageSize)
{
+ MESSAGE_CHECK(!imageHandle.isNull());
+ MESSAGE_CHECK(imageSize);
+
auto sharedMemoryBuffer = SharedMemory::map(imageHandle, SharedMemory::Protection::ReadOnly);
+ if (!sharedMemoryBuffer)
+ return;
+
auto buffer = SharedBuffer::create(static_cast<unsigned char*>(sharedMemoryBuffer->data()), imageSize);
pageClient().saveImageToLibrary(WTFMove(buffer));
}
@@ -1499,5 +1507,6 @@
} // namespace WebKit
#undef RELEASE_LOG_IF_ALLOWED
+#undef MESSAGE_CHECK
#endif // PLATFORM(IOS_FAMILY)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
