Title: [286327] trunk
- Revision
- 286327
- Author
- [email protected]
- Date
- 2021-11-30 14:23:54 -0800 (Tue, 30 Nov 2021)
Log Message
nullptr deref in InbandChapterTrackPrivateAVFObjC::processChapters
https://bugs.webkit.org/show_bug.cgi?id=233605
Patch by Gabriel Nava Marino <[email protected]> on 2021-11-30
Reviewed by Eric Carlson.
Source/WebCore:
The createChapterCue lambda gets dispatched onto the main thread. When it executes,
the client might no longer be valid, so we are adding a nullptr check at the start
of the lambda, as is done at the start of the method.
Test: media/track/track-in-band-chapters-invalid-client-crash.html
* platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm:
(WebCore::InbandChapterTrackPrivateAVFObjC::processChapters):
LayoutTests:
* media/track/track-in-band-chapters-invalid-client-crash-expected.txt: Added.
* media/track/track-in-band-chapters-invalid-client-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (286326 => 286327)
--- trunk/LayoutTests/ChangeLog 2021-11-30 22:17:15 UTC (rev 286326)
+++ trunk/LayoutTests/ChangeLog 2021-11-30 22:23:54 UTC (rev 286327)
@@ -1,3 +1,13 @@
+2021-11-30 Gabriel Nava Marino <[email protected]>
+
+ nullptr deref in InbandChapterTrackPrivateAVFObjC::processChapters
+ https://bugs.webkit.org/show_bug.cgi?id=233605
+
+ Reviewed by Eric Carlson.
+
+ * media/track/track-in-band-chapters-invalid-client-crash-expected.txt: Added.
+ * media/track/track-in-band-chapters-invalid-client-crash.html: Added.
+
2021-11-30 Robert Jenner <[email protected]>
[ Big Sur+ ] imported/w3c/web-platform-tests/fetch/content-type/script.window.html is failing
Added: trunk/LayoutTests/media/track/track-in-band-chapters-invalid-client-crash-expected.txt (0 => 286327)
--- trunk/LayoutTests/media/track/track-in-band-chapters-invalid-client-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/media/track/track-in-band-chapters-invalid-client-crash-expected.txt 2021-11-30 22:23:54 UTC (rev 286327)
@@ -0,0 +1 @@
+PASS if this doesn't crash
Added: trunk/LayoutTests/media/track/track-in-band-chapters-invalid-client-crash.html (0 => 286327)
--- trunk/LayoutTests/media/track/track-in-band-chapters-invalid-client-crash.html (rev 0)
+++ trunk/LayoutTests/media/track/track-in-band-chapters-invalid-client-crash.html 2021-11-30 22:23:54 UTC (rev 286327)
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+ let n14 = document.createElement('audio');
+ n14.src = '';
+ n14._onloadedmetadata_ = () => {
+ n14.src = '';
+ };
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+PASS if this doesn't crash
Modified: trunk/Source/WebCore/ChangeLog (286326 => 286327)
--- trunk/Source/WebCore/ChangeLog 2021-11-30 22:17:15 UTC (rev 286326)
+++ trunk/Source/WebCore/ChangeLog 2021-11-30 22:23:54 UTC (rev 286327)
@@ -1,3 +1,19 @@
+2021-11-30 Gabriel Nava Marino <[email protected]>
+
+ nullptr deref in InbandChapterTrackPrivateAVFObjC::processChapters
+ https://bugs.webkit.org/show_bug.cgi?id=233605
+
+ Reviewed by Eric Carlson.
+
+ The createChapterCue lambda gets dispatched onto the main thread. When it executes,
+ the client might no longer be valid, so we are adding a nullptr check at the start
+ of the lambda, as is done at the start of the method.
+
+ Test: media/track/track-in-band-chapters-invalid-client-crash.html
+
+ * platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm:
+ (WebCore::InbandChapterTrackPrivateAVFObjC::processChapters):
+
2021-11-30 Chris Dumez <[email protected]>
[Hardening] Early return in JSLazyEventListener::initializeJSFunction() if !settings().scriptMarkupEnabled()
Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm (286326 => 286327)
--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm 2021-11-30 22:17:15 UTC (rev 286326)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm 2021-11-30 22:23:54 UTC (rev 286327)
@@ -54,6 +54,8 @@
auto identifier = LOGIDENTIFIER;
auto createChapterCue = ([this, identifier] (AVMetadataItem *item, int chapterNumber) mutable {
+ if (!client())
+ return;
ChapterData chapterData = { PAL::toMediaTime([item time]), PAL::toMediaTime([item duration]), [item stringValue] };
if (m_processedChapters.contains(chapterData))
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
