Title: [292901] trunk/Source/WebCore
- Revision
- 292901
- Author
- [email protected]
- Date
- 2022-04-14 23:08:27 -0700 (Thu, 14 Apr 2022)
Log Message
[GTK] AddressSanitizer: heap-buffer-overflow in WebCore::Length::ref()
https://bugs.webkit.org/show_bug.cgi?id=237389
Reviewed by Žan Doberšek.
* platform/graphics/nicosia/NicosiaAnimation.cpp:
(Nicosia::createThreadsafeKeyFrames): Convert Length members of transform functions to
the fixed variety before they are moved to separate threads.
(Nicosia::Animation::Animation): Use the new helper.
* platform/graphics/transforms/TranslateTransformOperation.h: Added setters.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (292900 => 292901)
--- trunk/Source/WebCore/ChangeLog 2022-04-15 05:54:49 UTC (rev 292900)
+++ trunk/Source/WebCore/ChangeLog 2022-04-15 06:08:27 UTC (rev 292901)
@@ -1,3 +1,16 @@
+2022-04-14 Martin Robinson <[email protected]>
+
+ [GTK] AddressSanitizer: heap-buffer-overflow in WebCore::Length::ref()
+ https://bugs.webkit.org/show_bug.cgi?id=237389
+
+ Reviewed by Žan Doberšek.
+
+ * platform/graphics/nicosia/NicosiaAnimation.cpp:
+ (Nicosia::createThreadsafeKeyFrames): Convert Length members of transform functions to
+ the fixed variety before they are moved to separate threads.
+ (Nicosia::Animation::Animation): Use the new helper.
+ * platform/graphics/transforms/TranslateTransformOperation.h: Added setters.
+
2022-04-14 Zan Dobersek <[email protected]>
Unreviewed build fix for GTK and WPE.
Modified: trunk/Source/WebCore/platform/graphics/nicosia/NicosiaAnimation.cpp (292900 => 292901)
--- trunk/Source/WebCore/platform/graphics/nicosia/NicosiaAnimation.cpp 2022-04-15 05:54:49 UTC (rev 292900)
+++ trunk/Source/WebCore/platform/graphics/nicosia/NicosiaAnimation.cpp 2022-04-15 06:08:27 UTC (rev 292901)
@@ -21,6 +21,7 @@
#include "NicosiaAnimation.h"
#include "LayoutSize.h"
+#include "TranslateTransformOperation.h"
namespace Nicosia {
@@ -138,9 +139,35 @@
return CubicBezierTimingFunction::defaultTimingFunction();
}
+static KeyframeValueList createThreadsafeKeyFrames(const KeyframeValueList& originalKeyframes, const FloatSize& boxSize)
+{
+ if (originalKeyframes.property() != AnimatedPropertyTransform)
+ return originalKeyframes;
+
+ // Currently translation operations are the only transform operations that store a non-fixed
+ // Length. Some Lengths, in particular those for calc() operations, are not thread-safe or
+ // multiprocess safe, because they maintain indices into a shared HashMap of CalculationValues.
+ // This code converts all possible unsafe Length parameters to fixed Lengths, which are safe to
+ // use in other threads and across IPC channels.
+ KeyframeValueList keyframes = originalKeyframes;
+ for (unsigned i = 0; i < keyframes.size(); i++) {
+ const auto& transformValue = static_cast<const TransformAnimationValue&>(keyframes.at(i));
+ for (auto& operation : transformValue.value().operations()) {
+ if (is<TranslateTransformOperation>(operation)) {
+ TranslateTransformOperation* translation = static_cast<TranslateTransformOperation*>(operation.get());
+ translation->setX(Length(translation->xAsFloat(boxSize), LengthType::Fixed));
+ translation->setY(Length(translation->yAsFloat(boxSize), LengthType::Fixed));
+ translation->setZ(Length(translation->zAsFloat(), LengthType::Fixed));
+ }
+ }
+ }
+
+ return keyframes;
+}
+
Animation::Animation(const String& name, const KeyframeValueList& keyframes, const FloatSize& boxSize, const WebCore::Animation& animation, MonotonicTime startTime, Seconds pauseTime, AnimationState state)
: m_name(name.isSafeToSendToAnotherThread() ? name : name.isolatedCopy())
- , m_keyframes(keyframes)
+ , m_keyframes(createThreadsafeKeyFrames(keyframes, boxSize))
, m_boxSize(boxSize)
, m_timingFunction(animation.timingFunction()->clone())
, m_iterationCount(animation.iterationCount())
Modified: trunk/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.h (292900 => 292901)
--- trunk/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.h 2022-04-15 05:54:49 UTC (rev 292900)
+++ trunk/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.h 2022-04-15 06:08:27 UTC (rev 292901)
@@ -58,6 +58,10 @@
Length y() const { return m_y; }
Length z() const { return m_z; }
+ void setX(Length newX) { m_x = newX; }
+ void setY(Length newY) { m_y = newY; }
+ void setZ(Length newZ) { m_z = newZ; }
+
OperationType primitiveType() const final { return isRepresentableIn2D() ? TRANSLATE : TRANSLATE_3D; }
bool apply(TransformationMatrix& transform, const FloatSize& borderBoxSize) const final
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
