Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a1cadd6d818b849ae2489f287bcf712833119156
https://github.com/WebKit/WebKit/commit/a1cadd6d818b849ae2489f287bcf712833119156
Author: Zak Ridouh <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
A LayoutTests/ipc/set-window-frame-invalid-rect-no-crash-expected.txt
A LayoutTests/ipc/set-window-frame-invalid-rect-no-crash.html
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
Log Message:
-----------
Reject out-of-range window rects WebPageProxy::setWindowFrame
<https://bugs.webkit.org/show_bug.cgi?id=317683>
<rdar://180280759>
Reviewed by Abrar Rahman Protyasha.
A compromised web process can send SetWindowFrame with a NaN, infinite, or
out-of-int-range FloatRect. WebPageProxy forwarded it unchanged to the embedder,
where on macOS -[NSWindow setFrame:display:] asserts the frame fits within
{INT_MIN..INT_MAX} and terminates the UI process.
A well-behaved web process clamps the rect to the screen via adjustWindowRect,
so
an out-of-range rect indicates a malformed message and is now rejected with
MESSAGE_CHECK (isWithinIntRange also covers NaN and +/-Infinity). Since
WebAutomationSession also calls setWindowFrame directly, the check lives only in
the IPC receiver, which forwards to a new setWindowFrameInternal helper.
Test: ipc/set-window-frame-invalid-rect-no-crash.html
* LayoutTests/ipc/set-window-frame-invalid-rect-no-crash-expected.txt: Added.
* LayoutTests/ipc/set-window-frame-invalid-rect-no-crash.html: Added.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setWindowFrameIPC):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::sendSetWindowFrame):
Canonical link: https://commits.webkit.org/316679@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
