Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fef0d738b3ed58f8b7e8aed9d04cc837702954ac
https://github.com/WebKit/WebKit/commit/fef0d738b3ed58f8b7e8aed9d04cc837702954ac
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-13 (Sun, 13 Sep 2026)
Changed paths:
M Source/WebCore/Headers.cmake
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/platform/graphics/AV1Utilities.cpp
M Source/WebCore/platform/graphics/AV1Utilities.h
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WebCore/AV1UtilitiesTests.cpp
Log Message:
-----------
[AV1] Sequence header OBU that exactly fills the buffer is rejected by an
off-by-one bounds check
https://bugs.webkit.org/show_bug.cgi?id=324078
rdar://187306821
Reviewed by Jean-Yves Avenard.
getSequenceHeaderOBU() validates that a parsed OBU's payload fits within the
buffer before returning it, but used `index + payloadSize >= data.size()`. The
payload occupies the half-open range [index, index + payloadSize), so it fits
whenever `index + payloadSize <= data.size()`; the `>=` comparison wrongly
rejects an OBU that ends exactly at the end of the buffer. When the sequence
header is the last (or only) OBU in the stream — the common shape for an av1C
configuration record — createVideoInfoFromAV1Stream() then fails and returns
null. Corrected the check to `>`, matching the subsequent subspan(index,
payloadSize) which is valid in exactly that case.
Also exported AV1Utilities.h as a private WebCore header, consistent with its
VP9Utilities.h / H264UtilitiesCocoa.h siblings, so the new API test can include
it. This means listing it both in the Xcode project and in Headers.cmake so the
CMake-based ports (GTK/WPE) copy it into PrivateHeaders/; otherwise the new test
fails to build there with "WebCore/AV1Utilities.h: No such file or directory".
Test: Tools/TestWebKitAPI/Tests/WebCore/AV1UtilitiesTests.cpp
* Source/WebCore/Headers.cmake:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/platform/graphics/AV1Utilities.cpp:
(WebCore::getSequenceHeaderOBU):
* Source/WebCore/platform/graphics/AV1Utilities.h:
* Tools/TestWebKitAPI/CMakeLists.txt:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebCore/AV1UtilitiesTests.cpp: Added.
(TestWebKitAPI::TEST(AV1Utilities, SequenceHeaderOBUExactlyFillsBuffer)):
(TestWebKitAPI::TEST(AV1Utilities, SequenceHeaderOBUFollowedByTrailingData)):
(TestWebKitAPI::TEST(AV1Utilities, SequenceHeaderOBUPayloadExceedsBuffer)):
Canonical link: https://commits.webkit.org/321041@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
