Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b7324636a8621b0623e36f72c08544177043c457
https://github.com/WebKit/WebKit/commit/b7324636a8621b0623e36f72c08544177043c457
Author: Jean-Yves Avenard <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A
LayoutTests/ipc/display-capture-source-configuration-change-uaf-expected.txt
A LayoutTests/ipc/display-capture-source-configuration-change-uaf.html
M Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp
Log Message:
-----------
[CoreIPC][GPUP] UserMediaCaptureManagerProxySourceProxy can leave a dangling
VideoFrameObserver* in RealtimeMediaSource
rdar://174702504
Reviewed by Jer Noble.
UserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged()
re-registers
the proxy as a VideoFrameObserver of its RealtimeMediaSource via
removeVideoFrameObserver()/addVideoFrameObserver() without consulting
m_isObservingMedia.
Since the proxy is registered as a RealtimeMediaSourceObserver unconditionally
in its
constructor, this callback can fire on a stopped (or never-started) proxy and
insert a
raw VideoFrameObserver* into m_videoFrameObservers while m_isObservingMedia
remains
false. The destructor's unobserveMedia() then early-returns without removing
the entry.
DisplayCaptureSourceCocoa does not override clone(), so
UserMediaCaptureManagerProxy::clone()
yields two proxies sharing the same RealtimeMediaSource; the surviving clone
keeps the
source (and its dangling raw key) alive after the first proxy is freed, and the
next
videoFrameAvailable() virtual-dispatches through freed memory in the GPU
process. This
is reachable from a compromised WebContent process over
UserMediaCaptureManagerProxy IPC
once the page has been granted getDisplayMedia.
Guard the observer re-registration in sourceConfigurationChanged() on
m_isObservingMedia
so a stopped proxy is never re-inserted into m_videoFrameObservers.
* LayoutTests/ipc/display-capture-source-configuration-change-uaf-expected.txt:
Added.
* LayoutTests/ipc/display-capture-source-configuration-change-uaf.html: Added.
* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:
(WebKit::UserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged):
Originally-landed-as: [email protected] (a06fd51c1706).
rdar://185367909
Canonical link: https://commits.webkit.org/320368@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
