Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: c61dd264610bfefcb0885c0fe4366a7a3301b97f
https://github.com/WebKit/WebKit/commit/c61dd264610bfefcb0885c0fe4366a7a3301b97f
Author: Roberto Rodriguez <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
M Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm
M Tools/TestWebKitAPI/Tests/WebCore/glib/GraphicsContextGLTextureMapper.cpp
Log Message:
-----------
Cherry-pick [email protected] (737f43a06688).
https://bugs.webkit.org/show_bug.cgi?id=316355
[WebGL] Reject offset-based GL calls when no buffer is bound
https://bugs.webkit.org/show_bug.cgi?id=316355
rdar://178074009
Reviewed by Kimmo Kinnunen.
An upstream ANGLE update (
https://chromium.googlesource.com/angle/angle/+/849f71287df00f4984264b900fb88fd780864f50
)
removed validation that previously rejected compressed texture uploads when
no pixel unpack buffer was bound. Without
it, a compromised web content process can send a compressed texture upload
IPC message (the PBO-offset variant) with a
chosen address and no pixel unpack buffer bound. The GPU process passes the
address to Metal which reads from it into
a texture, giving the attacker arbitrary read access in GPU process.
Add buffer-binding guards to offset-based overloads in
GraphicsContextGLANGLE that cast an IPC-supplied offset to a
pointer. Check GL_PIXEL_UNPACK_BUFFER_BINDING for texture uploads. Return
GL_INVALID_OPERATION if no buffer is bound.
Add API tests in TestGraphicsContextGLCocoa that verify each guarded
overload rejects when no buffer is bound.
Test: Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm
* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:
(WebCore::GraphicsContextGLANGLE::texImage2D):
(WebCore::GraphicsContextGLANGLE::texSubImage2D):
(WebCore::GraphicsContextGLANGLE::compressedTexImage2D):
(WebCore::GraphicsContextGLANGLE::compressedTexSubImage2D):
(WebCore::GraphicsContextGLANGLE::texImage3D):
(WebCore::GraphicsContextGLANGLE::texSubImage3D):
(WebCore::GraphicsContextGLANGLE::compressedTexImage3D):
(WebCore::GraphicsContextGLANGLE::compressedTexSubImage3D):
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm:
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
ClearBufferIncorrectSizes)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexSubImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexImage3DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CompressedTexSubImage3DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexSubImage2DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexImage3DRejectsOffsetWithNoPBO)):
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
TexSubImage3DRejectsOffsetWithNoPBO)):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1178@webkitglib/2.52
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
