Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5d977a0a03600c676749065916a89af91ec2d687
https://github.com/WebKit/WebKit/commit/5d977a0a03600c676749065916a89af91ec2d687
Author: Youenn Fablet <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
Log Message:
-----------
[CoreIPC] RemoteVideoFrameObjectHeap::convertFrameBuffer uninitialized GPUP
heap disclosure via SharedVideoFrameInfo bytesPerRow
rdar://174529502
Reviewed by Jean-Yves Avenard.
If crafting an IPC message containing a SharedVideoFrameInfo with
bytesPerRow=0, a WebProcess can learn about uninitialized memory.
To prevent this, we memset the allocated CVPixelBuffer data to 0.
* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:
(WebCore::copyToCVPixelBufferPlane):
Originally-landed-as: 305413.766@safari-7624-branch (4d49c876befa).
rdar://180427261
Canonical link: https://commits.webkit.org/316032@main
Commit: 7c03dc511c70a90534618e5592a4bc07d91f70a3
https://github.com/WebKit/WebKit/commit/7c03dc511c70a90534618e5592a4bc07d91f70a3
Author: Youenn Fablet <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm
Log Message:
-----------
[CoreIPC] RemoteVideoFrameObjectHeap::convertFrameBuffer uninitialized GPUP
heap disclosure via SharedVideoFrameInfo bytesPerRow
rdar://174529502
Reviewed by Jean-Yves Avenard.
If crafting an IPC message containing a SharedVideoFrameInfo with
bytesPerRow=0, a WebProcess can learn about uninitialized memory.
To prevent this, we memset the allocated CVPixelBuffer data to 0.
* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:
(WebCore::copyToCVPixelBufferPlane):
Originally-landed-as: 305413.837@safari-7624-branch (b61fc5f3853e).
rdar://180427261
Canonical link: https://commits.webkit.org/316033@main
Compare: https://github.com/WebKit/WebKit/compare/5c9eba910d58...7c03dc511c70
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
