Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b6908339696324c13c05000979821df430e2cefa
https://github.com/WebKit/WebKit/commit/b6908339696324c13c05000979821df430e2cefa
Author: Zak Ridouh <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure-expected.txt
A
LayoutTests/ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure.html
M Source/WebCore/platform/graphics/PixelBufferConversion.cpp
Log Message:
-----------
Uninitialized-heap disclosure in convertImagePixelsFromFloat16ToFloat16 via
color-space early-return
<https://bugs.webkit.org/show_bug.cgi?id=314590>
<rdar://176483321>
Reviewed by Gerald Squelart.
convertImagePixelsFromFloat16ToFloat16() early-returned on a color-space
mismatch without writing the destination. The destination buffer is allocated
via JSC::Float16Array::tryCreateUninitialized() and ImageBufferBackend::
getPixelBuffer() only zero-fills on a size mismatch, so an RGBA16F
getPixelBuffer() readback whose output color space differed from the backing
IOSurface's left the destination populated with uninitialized
Gigacage::Primitive heap. RemoteImageBuffer::getPixelBufferWithNewMemory()
then memcpy'd those bytes into WebContent-mapped shared memory causing a
WebContent<->GPUProcess heap disclosure.
Float16<->Float16 color-space conversion is unimplemented (the 8-bit sibling
path also doesn't perform it). Remove the early return so the destination
is always populated with the source pixels (alpha-format conversion applied),
matching the sibling's behavior and closing the disclosure.
Test: ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure.html
*
LayoutTests/ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure-expected.txt:
Added.
*
LayoutTests/ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure.html:
Added.
* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:
(WebCore::convertImagePixelsFromFloat16ToFloat16):
Originally-landed-as: 305413.933@safari-7624-branch (e7a0eda7b7ff).
rdar://180428968
Canonical link: https://commits.webkit.org/316117@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
