Title: [238799] trunk/Source/WebKit
- Revision
- 238799
- Author
- [email protected]
- Date
- 2018-12-03 09:18:57 -0800 (Mon, 03 Dec 2018)
Log Message
[Cocoa] Check descriptor types in createMessageDecoder
https://bugs.webkit.org/show_bug.cgi?id=192302
Reviewed by Chris Dumez.
Not sure how to construct a test case for Connection, so not adding any
tests at this time.
* Platform/IPC/mac/ConnectionMac.mm:
(IPC::createMessageDecoder): Check descriptor types and return nullptr if they
are incorrect. Retained the assertions to help with debugging.
(IPC::Connection::receiveSourceEventHandler): Ignore the message if no decoder
is created, which means the message is invalid.
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (238798 => 238799)
--- trunk/Source/WebKit/ChangeLog 2018-12-03 17:16:03 UTC (rev 238798)
+++ trunk/Source/WebKit/ChangeLog 2018-12-03 17:18:57 UTC (rev 238799)
@@ -1,5 +1,21 @@
2018-12-03 Darin Adler <[email protected]>
+ [Cocoa] Check descriptor types in createMessageDecoder
+ https://bugs.webkit.org/show_bug.cgi?id=192302
+
+ Reviewed by Chris Dumez.
+
+ Not sure how to construct a test case for Connection, so not adding any
+ tests at this time.
+
+ * Platform/IPC/mac/ConnectionMac.mm:
+ (IPC::createMessageDecoder): Check descriptor types and return nullptr if they
+ are incorrect. Retained the assertions to help with debugging.
+ (IPC::Connection::receiveSourceEventHandler): Ignore the message if no decoder
+ is created, which means the message is invalid.
+
+2018-12-03 Darin Adler <[email protected]>
+
Alignment padding needs to be zeroed out in IPC::Encoder
https://bugs.webkit.org/show_bug.cgi?id=192304
Modified: trunk/Source/WebKit/Platform/IPC/mac/ConnectionMac.mm (238798 => 238799)
--- trunk/Source/WebKit/Platform/IPC/mac/ConnectionMac.mm 2018-12-03 17:16:03 UTC (rev 238798)
+++ trunk/Source/WebKit/Platform/IPC/mac/ConnectionMac.mm 2018-12-03 17:18:57 UTC (rev 238799)
@@ -438,29 +438,26 @@
for (mach_msg_size_t i = 0; i < numDescriptors; ++i) {
mach_msg_descriptor_t* descriptor = reinterpret_cast<mach_msg_descriptor_t*>(descriptorData);
+ ASSERT(descriptor->type.type == MACH_MSG_PORT_DESCRIPTOR);
+ if (descriptor->type.type != MACH_MSG_PORT_DESCRIPTOR)
+ return nullptr;
- switch (descriptor->type.type) {
- case MACH_MSG_PORT_DESCRIPTOR:
- attachments[numDescriptors - i - 1] = Attachment(descriptor->port.name, descriptor->port.disposition);
- descriptorData += sizeof(mach_msg_port_descriptor_t);
- break;
- default:
- ASSERT(false && "Unhandled descriptor type");
- }
+ attachments[numDescriptors - i - 1] = Attachment(descriptor->port.name, descriptor->port.disposition);
+ descriptorData += sizeof(mach_msg_port_descriptor_t);
}
if (messageBodyIsOOL) {
mach_msg_descriptor_t* descriptor = reinterpret_cast<mach_msg_descriptor_t*>(descriptorData);
ASSERT(descriptor->type.type == MACH_MSG_OOL_DESCRIPTOR);
+ if (descriptor->type.type != MACH_MSG_OOL_DESCRIPTOR)
+ return nullptr;
uint8_t* messageBody = static_cast<uint8_t*>(descriptor->out_of_line.address);
size_t messageBodySize = descriptor->out_of_line.size;
- auto decoder = std::make_unique<Decoder>(messageBody, messageBodySize, [](const uint8_t* buffer, size_t length) {
+ return std::make_unique<Decoder>(messageBody, messageBodySize, [](const uint8_t* buffer, size_t length) {
vm_deallocate(mach_task_self(), reinterpret_cast<vm_address_t>(buffer), length);
}, WTFMove(attachments));
-
- return decoder;
}
uint8_t* messageBody = descriptorData;
@@ -528,7 +525,8 @@
}
std::unique_ptr<Decoder> decoder = createMessageDecoder(header);
- ASSERT(decoder);
+ if (!decoder)
+ return;
#if PLATFORM(MAC)
decoder->setImportanceAssertion(std::make_unique<ImportanceAssertion>(header));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
