Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog (282510 => 282511)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-09-16 08:40:44 UTC (rev 282510)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-09-16 08:51:15 UTC (rev 282511)
@@ -1,3 +1,25 @@
+2021-04-26 Tim Nguyen <[email protected]>
+
+ Add more eager OOB checks when creating DisplayListReaderHandle & DisplayListWriterHandle.
+ https://bugs.webkit.org/show_bug.cgi?id=225055
+ <rdar://71896663>
+
+ Reviewed by Wenson Hsieh.
+
+ There were already some OOB checks for both classes, this revision adds checks at creation-time.
+ Also add a comment on top of SharedDisplayListHandle.h to mention that only subclasses use it.
+
+ * GPUProcess/graphics/DisplayListReaderHandle.h:
+ (WebKit::DisplayListReaderHandle::create):
+ * GPUProcess/graphics/RemoteRenderingBackend.cpp:
+ (WebKit::RemoteRenderingBackend::didCreateSharedDisplayListHandle):
+ * Shared/SharedDisplayListHandle.h:
+ (WebKit::SharedDisplayListHandle::SharedDisplayListHandle):
+ * WebProcess/GPU/graphics/DisplayListWriterHandle.h:
+ (WebKit::DisplayListWriterHandle::create):
+ * WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
+ (WebKit::RemoteRenderingBackendProxy::createItemBuffer):
+
2021-04-06 Ryosuke Niwa <[email protected]>
Delay the end of printing while PrintContext is in use.
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/GPUProcess/graphics/DisplayListReaderHandle.h (282510 => 282511)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/GPUProcess/graphics/DisplayListReaderHandle.h 2021-09-16 08:40:44 UTC (rev 282510)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/GPUProcess/graphics/DisplayListReaderHandle.h 2021-09-16 08:51:15 UTC (rev 282511)
@@ -34,9 +34,11 @@
class DisplayListReaderHandle : public SharedDisplayListHandle {
WTF_MAKE_NONCOPYABLE(DisplayListReaderHandle); WTF_MAKE_FAST_ALLOCATED;
public:
- static Ref<DisplayListReaderHandle> create(WebCore::DisplayList::ItemBufferIdentifier identifier, Ref<SharedMemory>&& sharedMemory)
+ static RefPtr<DisplayListReaderHandle> create(WebCore::DisplayList::ItemBufferIdentifier identifier, Ref<SharedMemory>&& sharedMemory)
{
- return adoptRef(*new DisplayListReaderHandle(identifier, WTFMove(sharedMemory)));
+ if (sharedMemory->size() <= headerSize())
+ return nullptr;
+ return adoptRef(new DisplayListReaderHandle(identifier, WTFMove(sharedMemory)));
}
Optional<size_t> advance(size_t amount);
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp (282510 => 282511)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp 2021-09-16 08:40:44 UTC (rev 282510)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp 2021-09-16 08:51:15 UTC (rev 282511)
@@ -420,8 +420,11 @@
ASSERT(!RunLoop::isMain());
MESSAGE_CHECK(!m_sharedDisplayListHandles.contains(identifier), "Duplicate shared display list handle");
- if (auto sharedMemory = SharedMemory::map(handle.handle, SharedMemory::Protection::ReadWrite))
- m_sharedDisplayListHandles.set(identifier, DisplayListReaderHandle::create(identifier, sharedMemory.releaseNonNull()));
+ if (auto sharedMemory = SharedMemory::map(handle.handle, SharedMemory::Protection::ReadWrite)) {
+ auto handle = DisplayListReaderHandle::create(identifier, sharedMemory.releaseNonNull());
+ MESSAGE_CHECK(handle, "There must be enough space to create the handle.");
+ m_sharedDisplayListHandles.set(identifier, handle);
+ }
if (m_pendingWakeupInfo && m_pendingWakeupInfo->shouldPerformWakeup(identifier))
wakeUpAndApplyDisplayList(std::exchange(m_pendingWakeupInfo, WTF::nullopt)->arguments);
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/SharedDisplayListHandle.h (282510 => 282511)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/SharedDisplayListHandle.h 2021-09-16 08:40:44 UTC (rev 282510)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/Shared/SharedDisplayListHandle.h 2021-09-16 08:51:15 UTC (rev 282511)
@@ -33,6 +33,7 @@
namespace WebKit {
+// This is a skeleton only used by the DisplayListWriterHandle & DisplayListReaderHandle subclasses.
class SharedDisplayListHandle : public RefCounted<SharedDisplayListHandle> {
public:
virtual ~SharedDisplayListHandle() = default;
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/WebProcess/GPU/graphics/DisplayListWriterHandle.h (282510 => 282511)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/WebProcess/GPU/graphics/DisplayListWriterHandle.h 2021-09-16 08:40:44 UTC (rev 282510)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/WebProcess/GPU/graphics/DisplayListWriterHandle.h 2021-09-16 08:51:15 UTC (rev 282511)
@@ -33,9 +33,11 @@
class DisplayListWriterHandle : public SharedDisplayListHandle {
WTF_MAKE_NONCOPYABLE(DisplayListWriterHandle); WTF_MAKE_FAST_ALLOCATED;
public:
- static Ref<DisplayListWriterHandle> create(WebCore::DisplayList::ItemBufferIdentifier identifier, Ref<SharedMemory>&& sharedMemory)
+ static RefPtr<DisplayListWriterHandle> create(WebCore::DisplayList::ItemBufferIdentifier identifier, Ref<SharedMemory>&& sharedMemory)
{
- return adoptRef(*new DisplayListWriterHandle(identifier, WTFMove(sharedMemory)));
+ if (sharedMemory->size() <= headerSize())
+ return nullptr;
+ return adoptRef(new DisplayListWriterHandle(identifier, WTFMove(sharedMemory)));
}
size_t writableOffset() const { return m_writableOffset; }
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp (282510 => 282511)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp 2021-09-16 08:40:44 UTC (rev 282510)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp 2021-09-16 08:51:15 UTC (rev 282511)
@@ -366,6 +366,7 @@
send(Messages::RemoteRenderingBackend::DidCreateSharedDisplayListHandle(identifier, { WTFMove(sharedMemoryHandle), sharedMemory->size() }, destinationBufferIdentifier), m_renderingBackendIdentifier);
auto newHandle = DisplayListWriterHandle::create(identifier, sharedMemory.releaseNonNull());
+ RELEASE_ASSERT(newHandle, "There must be enough space to create the handle.");
auto displayListHandle = newHandle->createHandle();
m_identifiersOfReusableHandles.prepend(identifier);
