Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 487e5a08ac6cf4bc87660eaebc2e05e72bf0504b
https://github.com/WebKit/WebKit/commit/487e5a08ac6cf4bc87660eaebc2e05e72bf0504b
Author: Roberto Rodriguez <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm
Log Message:
-----------
[WebGL] Reject offset-based GL calls when no buffer is bound
https://bugs.webkit.org/show_bug.cgi?id=316355
rdar://178074009
Reviewed by Kimmo Kinnunen.
An upstream ANGLE update (
https://flagged.apple.com:443/proxy?t2=Dy7T6r6RR4&o=aHR0cHM6Ly9jaHJvbWl1bS5nb29nbGVzb3VyY2UuY29tL2FuZ2xlL2FuZ2xlLysvODQ5ZjcxMjg3ZGYwMGY0OTg0MjY0YjkwMGZiODhmZDc4MDg2NGY1MA==&emid=ec2defbc-40d4-4be2-aa3d-6bf537f92ddb&c=11
)
removed validation that previously rejected compressed texture
uploads
when no pixel unpack buffer was bound. Without
it, a compromised web content process can send a compressed texture upload IPC
message (the PBO-offset variant) with a
chosen address and no pixel unpack buffer bound. The GPU process passes the
address to Metal which reads from it into
a texture, giving the attacker arbitrary read access in GPU process.
Add buffer-binding guards to offset-based overloads in GraphicsContextGLANGLE
that cast an IPC-supplied offset to a
pointer. Check GL_PIXEL_UNPACK_BUFFER_BINDING for texture uploads. Return
GL_INVALID_OPERATION if no buffer is bound.
Add API tests in TestGraphicsContextGLCocoa that verify each guarded overload
rejects when no buffer is bound.
Test:
Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm
*
Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:
(WebCore::GraphicsContextGLANGLE::texImage2D):
(WebCore::GraphicsContextGLANGLE::texSubImage2D):
(WebCore::GraphicsContextGLANGLE::compressedTexImage2D):
(WebCore::GraphicsContextGLANGLE::compressedTexSubImage2D):
(WebCore::GraphicsContextGLANGLE::texImage3D):
(WebCore::GraphicsContextGLANGLE::texSubImage3D):
(WebCore::GraphicsContextGLANGLE::compressedTexImage3D):
(WebCore::GraphicsContextGLANGLE::compressedTexSubImage3D):
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm:
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, ClearBufferIncorrectSizes)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexSubImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexImage3DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexSubImage3DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexSubImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexImage3DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexSubImage3DRejectsOffsetWithNoPBO)):
Originally-landed-as: [email protected] (737f43a06688).
rdar://185368753
Canonical link:
https://flagged.apple.com:443/proxy?t2=DW3V8A7Iu4&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIwMzcxQG1haW4=&emid=ec2defbc-40d4-4be2-aa3d-6bf537f92ddb&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
