Title: [282521] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 282521
- Author
- [email protected]
- Date
- 2021-09-16 02:52:29 -0700 (Thu, 16 Sep 2021)
Log Message
Merge r277602 - [GPU Process] Validate DocumentMarkerLineStyle::Mode when decoding DrawDotsForDocumentMarker
https://bugs.webkit.org/show_bug.cgi?id=225874
rdar://77885775
Reviewed by Simon Fraser.
Add validation around the style mode enum in `DrawDotsForDocumentMarker`'s `DocumentMarkerLineStyle`. To ensure
that these enum values are safely decoded when deserializing `DrawDotsForDocumentMarker` items from arbitrary
data, we store and read the style mode as `DocumentMarkerLineStyle::Mode`'s underlying type: a `uint8_t`. Upon
item validation, we'll then return `false` from `isValid()` in the case where the underlying value is not a
valid `DocumentMarkerLineStyle::Mode`.
This is necessary because copying invalid enum class types triggers undefined behavior in C++, so we need to
avoid copying the enum value as a `DocumentMarkerLineStyle::Mode` prior to validation.
* platform/graphics/displaylists/DisplayListItems.cpp:
(WebCore::DisplayList::operator<<):
(WebCore::DisplayList::DrawDotsForDocumentMarker::isValid const):
* platform/graphics/displaylists/DisplayListItems.h:
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (282520 => 282521)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 09:52:21 UTC (rev 282520)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 09:52:29 UTC (rev 282521)
@@ -1,3 +1,25 @@
+2021-05-17 Wenson Hsieh <[email protected]>
+
+ [GPU Process] Validate DocumentMarkerLineStyle::Mode when decoding DrawDotsForDocumentMarker
+ https://bugs.webkit.org/show_bug.cgi?id=225874
+ rdar://77885775
+
+ Reviewed by Simon Fraser.
+
+ Add validation around the style mode enum in `DrawDotsForDocumentMarker`'s `DocumentMarkerLineStyle`. To ensure
+ that these enum values are safely decoded when deserializing `DrawDotsForDocumentMarker` items from arbitrary
+ data, we store and read the style mode as `DocumentMarkerLineStyle::Mode`'s underlying type: a `uint8_t`. Upon
+ item validation, we'll then return `false` from `isValid()` in the case where the underlying value is not a
+ valid `DocumentMarkerLineStyle::Mode`.
+
+ This is necessary because copying invalid enum class types triggers undefined behavior in C++, so we need to
+ avoid copying the enum value as a `DocumentMarkerLineStyle::Mode` prior to validation.
+
+ * platform/graphics/displaylists/DisplayListItems.cpp:
+ (WebCore::DisplayList::operator<<):
+ (WebCore::DisplayList::DrawDotsForDocumentMarker::isValid const):
+ * platform/graphics/displaylists/DisplayListItems.h:
+
2021-05-17 Frederic Wang <[email protected]>
REGRESSION(r277425): Crash in FrameSelection::selectFrameElementInParentIfFullySelected
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp (282520 => 282521)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp 2021-09-16 09:52:21 UTC (rev 282520)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp 2021-09-16 09:52:29 UTC (rev 282521)
@@ -576,7 +576,10 @@
void DrawDotsForDocumentMarker::apply(GraphicsContext& context) const
{
- context.drawDotsForDocumentMarker(m_rect, m_style);
+ context.drawDotsForDocumentMarker(m_rect, {
+ static_cast<DocumentMarkerLineStyle::Mode>(m_styleMode),
+ m_styleShouldUseDarkAppearance,
+ });
}
Optional<FloatRect> DrawDotsForDocumentMarker::localBounds(const GraphicsContext&) const
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/platform/graphics/displaylists/DisplayListItems.h (282520 => 282521)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/platform/graphics/displaylists/DisplayListItems.h 2021-09-16 09:52:21 UTC (rev 282520)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/platform/graphics/displaylists/DisplayListItems.h 2021-09-16 09:52:29 UTC (rev 282521)
@@ -37,6 +37,7 @@
#include "Pattern.h"
#include "RenderingResourceIdentifier.h"
#include "SharedBuffer.h"
+#include <wtf/EnumTraits.h>
#include <wtf/TypeCasts.h>
namespace WTF {
@@ -1258,12 +1259,24 @@
static constexpr bool isInlineItem = true;
static constexpr bool isDrawingItem = true;
- DrawDotsForDocumentMarker(const FloatRect& rect, DocumentMarkerLineStyle style)
+ using UnderlyingDocumentMarkerLineStyleType = std::underlying_type<DocumentMarkerLineStyle::Mode>::type;
+
+ DrawDotsForDocumentMarker(const FloatRect& rect, const DocumentMarkerLineStyle& style)
: m_rect(rect)
- , m_style(style)
+ , m_styleMode(static_cast<UnderlyingDocumentMarkerLineStyleType>(style.mode))
+ , m_styleShouldUseDarkAppearance(style.shouldUseDarkAppearance)
{
}
+ DrawDotsForDocumentMarker(const FloatRect& rect, UnderlyingDocumentMarkerLineStyleType styleMode, bool styleShouldUseDarkAppearance)
+ : m_rect(rect)
+ , m_styleMode(styleMode)
+ , m_styleShouldUseDarkAppearance(styleShouldUseDarkAppearance)
+ {
+ }
+
+ bool isValid() const { return isValidEnum<DocumentMarkerLineStyle::Mode>(m_styleMode); }
+
FloatRect rect() const { return m_rect; }
void apply(GraphicsContext&) const;
@@ -1273,7 +1286,8 @@
private:
FloatRect m_rect;
- DocumentMarkerLineStyle m_style;
+ UnderlyingDocumentMarkerLineStyleType m_styleMode { 0 };
+ bool m_styleShouldUseDarkAppearance { false };
};
class DrawEllipse {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
