Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b5b4ce70e1fb3cc097222cd3a13bd9cabe2b9756
https://github.com/WebKit/WebKit/commit/b5b4ce70e1fb3cc097222cd3a13bd9cabe2b9756
Author: Jer Noble <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
A
LayoutTests/media/media-source/media-source-remove-divisible-sample-overlap-expected.txt
A
LayoutTests/media/media-source/media-source-remove-divisible-sample-overlap.html
M Source/WebCore/platform/graphics/TrackBuffer.cpp
Log Message:
-----------
CRASH in TrackBuffer::removeCodedFrames(...)
rdar://180378045
https://bugs.webkit.org/show_bug.cgi?id=317770
Reviewed by Jean-Yves Avenard.
When splitting a sample during a remove() operation, it's possible to have the
start time for the removal range
to advance such that it becomes >= the end time, which causes subsequent range
iterations to walk off the end of
the SampleMap and hit a null dereference when incrementing the end() iterator.
Protect against this by adding an
additional order validation step before iterating over the discovered range.
Because this same pattern exists in
TrackBuffer::codedFramesIntervalSize(...) as well, perform the same validation
there.
Test: media/media-source/media-source-remove-divisible-sample-overlap.html
*
LayoutTests/media/media-source/media-source-remove-divisible-sample-overlap-expected.txt:
Added.
*
LayoutTests/media/media-source/media-source-remove-divisible-sample-overlap.html:
Added.
* Source/WebCore/platform/graphics/TrackBuffer.cpp:
(WebCore::TrackBuffer::removeCodedFrames):
(WebCore::TrackBuffer::codedFramesIntervalSize):
Canonical link: https://commits.webkit.org/315869@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
