Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4fa207d1c8d4a14afbda9ffa02b9070effd52d9b
https://github.com/WebKit/WebKit/commit/4fa207d1c8d4a14afbda9ffa02b9070effd52d9b
Author: Jer Noble <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A
LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt
A LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html
M Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp
Log Message:
-----------
[WebCore] Memory underflow in PlatformRawAudioData::copyTo()
rdar://176473804
https://bugs.webkit.org/show_bug.cgi?id=318500
Reviewed by Jean-Yves Avenard
When PlatformRawAudioData::copyTo() is told to copy zero samples, just bail out
early. This
avoids a calculation where the number of samples has 1 subtracted from it,
causing a math
underflow.
Cherry-pick https://commits.webkit.org/314451@main for test to pass.
Test: fast/webcodecs/audio-data-copy-to-zero-frames-crash.html
* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt:
Added.
* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html: Added.
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.js:
(test):
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.worker-expected.txt:
* Source/WebCore/Modules/webcodecs/WebCodecsAudioDataAlgorithms.cpp:
(WebCore::computeCopyElementCount):
* Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp:
(WebCore::PlatformRawAudioData::copyTo):
Originally-landed-as: [email protected] (6b8717a224a0).
rdar://185368929
Canonical link: https://commits.webkit.org/319651@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
