Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 54b8e49ebf3396dbcea92fcbbcec2a0233264291
https://github.com/WebKit/WebKit/commit/54b8e49ebf3396dbcea92fcbbcec2a0233264291
Author: Youenn Fablet <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A LayoutTests/fast/mediastream/applyConstraints-with-takePhoto-expected.txt
A LayoutTests/fast/mediastream/applyConstraints-with-takePhoto.html
M Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp
Log Message:
-----------
Heap UaF in GPU Process via MediaStreamTrack.clone() +
ImageCapture.takePhoto() + applyConstraints()
rdar://176025005
Reviewed by Eric Carlson.
We store constraints in the callback by value instead of reference to make sure
that the constraints are valid if the callback is called asynchronously.
Test: fast/mediastream/applyConstraints-with-takePhoto.html
* LayoutTests/fast/mediastream/applyConstraints-with-takePhoto-expected.txt:
Added.
* LayoutTests/fast/mediastream/applyConstraints-with-takePhoto.html: Added.
* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:
Originally-landed-as: 305413.816@safari-7624-branch (207238632262).
rdar://180436666
Canonical link: https://commits.webkit.org/316184@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
