Diff
Modified: trunk/LayoutTests/ChangeLog (251006 => 251007)
--- trunk/LayoutTests/ChangeLog 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/LayoutTests/ChangeLog 2019-10-11 14:18:01 UTC (rev 251007)
@@ -1,3 +1,19 @@
+2019-10-11 Bjorn Melinder <[email protected]>
+
+ OfflineAudioContext does not validate allocation of destination buffer
+ https://bugs.webkit.org/show_bug.cgi?id=177259
+
+ Reviewed by Eric Carlson.
+
+ Moved the allocation of the destination buffer to the static
+ OfflineAudioContext::create method where we are able to handle a failed
+ allocation properly and return an Exception. This change handles both
+ negative lengths as well as too large lengths where the memory cannot
+ be allocated.
+
+ * webaudio/offlineaudiocontext-constructor-expected.txt:
+ * webaudio/offlineaudiocontext-constructor.html:
+
2019-10-11 Chris Lord <[email protected]>
Flaky test: imported/w3c/web-platform-tests/offscreen-canvas/compositing/2d.composite.canvas.destination-in.html
Modified: trunk/LayoutTests/webaudio/offlineaudiocontext-constructor-expected.txt (251006 => 251007)
--- trunk/LayoutTests/webaudio/offlineaudiocontext-constructor-expected.txt 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/LayoutTests/webaudio/offlineaudiocontext-constructor-expected.txt 2019-10-11 14:18:01 UTC (rev 251007)
@@ -4,6 +4,8 @@
PASS new webkitOfflineAudioContext(1, 0, 44100) threw exception SyntaxError: The string did not match the expected pattern..
+PASS new webkitOfflineAudioContext(1, -1, 44100) threw exception SyntaxError: The string did not match the expected pattern..
+PASS new webkitOfflineAudioContext(1, 99999999999, 44100) threw exception SyntaxError: The string did not match the expected pattern..
PASS new webkitOfflineAudioContext(0, 1, 44100) threw exception SyntaxError: The string did not match the expected pattern..
PASS new webkitOfflineAudioContext(1, 1, 0) threw exception SyntaxError: The string did not match the expected pattern..
PASS new webkitOfflineAudioContext(1, 1, 44100) did not throw exception.
Modified: trunk/LayoutTests/webaudio/offlineaudiocontext-constructor.html (251006 => 251007)
--- trunk/LayoutTests/webaudio/offlineaudiocontext-constructor.html 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/LayoutTests/webaudio/offlineaudiocontext-constructor.html 2019-10-11 14:18:01 UTC (rev 251007)
@@ -6,6 +6,8 @@
<script>
description('This tests that passing zero to the "numberOfFrames" parameter of the OfflineAudioContext constructor does not cause a crash.');
shouldThrow('new webkitOfflineAudioContext(1, 0, 44100)');
+ shouldThrow('new webkitOfflineAudioContext(1, -1, 44100)');
+ shouldThrow('new webkitOfflineAudioContext(1, 99999999999, 44100)');
shouldThrow('new webkitOfflineAudioContext(0, 1, 44100)');
shouldThrow('new webkitOfflineAudioContext(1, 1, 0)');
shouldNotThrow('new webkitOfflineAudioContext(1, 1, 44100)');
Modified: trunk/Source/WebCore/ChangeLog (251006 => 251007)
--- trunk/Source/WebCore/ChangeLog 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/Source/WebCore/ChangeLog 2019-10-11 14:18:01 UTC (rev 251007)
@@ -1,3 +1,24 @@
+2019-10-11 Bjorn Melinder <[email protected]>
+
+ OfflineAudioContext does not validate allocation of destination buffer
+ https://bugs.webkit.org/show_bug.cgi?id=177259
+
+ Reviewed by Eric Carlson.
+
+ Moved the allocation of the destination buffer to the static
+ OfflineAudioContext::create method where we are able to handle a failed
+ allocation properly and return an Exception. This change handles both
+ negative lengths as well as too large lengths where the memory cannot
+ be allocated.
+
+ * Modules/webaudio/AudioContext.cpp:
+ (WebCore::AudioContext::AudioContext):
+ * Modules/webaudio/AudioContext.h:
+ * Modules/webaudio/OfflineAudioContext.cpp:
+ (WebCore::OfflineAudioContext::OfflineAudioContext):
+ (WebCore::OfflineAudioContext::create):
+ * Modules/webaudio/OfflineAudioContext.h:
+
2019-10-10 Konstantin Tokarev <[email protected]>
Guard GCrypt-specific code with USE(GCRYPT) instead of PLATFORM macros
Modified: trunk/Source/WebCore/Modules/webaudio/AudioContext.cpp (251006 => 251007)
--- trunk/Source/WebCore/Modules/webaudio/AudioContext.cpp 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/Source/WebCore/Modules/webaudio/AudioContext.cpp 2019-10-11 14:18:01 UTC (rev 251007)
@@ -158,7 +158,7 @@
}
// Constructor for offline (non-realtime) rendering.
-AudioContext::AudioContext(Document& document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
+AudioContext::AudioContext(Document& document, AudioBuffer* renderTarget)
: ActiveDOMObject(document)
#if !RELEASE_LOG_DISABLED
, m_logger(document.logger())
@@ -167,11 +167,11 @@
, m_isOfflineContext(true)
, m_mediaSession(PlatformMediaSession::create(*this))
, m_eventQueue(MainThreadGenericEventQueue::create(*this))
+ , m_renderTarget(renderTarget)
{
constructCommon();
// Create a new destination for offline rendering.
- m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
m_destinationNode = OfflineAudioDestinationNode::create(*this, m_renderTarget.get());
}
Modified: trunk/Source/WebCore/Modules/webaudio/AudioContext.h (251006 => 251007)
--- trunk/Source/WebCore/Modules/webaudio/AudioContext.h 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/Source/WebCore/Modules/webaudio/AudioContext.h 2019-10-11 14:18:01 UTC (rev 251007)
@@ -296,7 +296,7 @@
protected:
explicit AudioContext(Document&);
- AudioContext(Document&, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate);
+ AudioContext(Document&, AudioBuffer* renderTarget);
static bool isSampleRateRangeGood(float sampleRate);
void clearPendingActivity();
Modified: trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.cpp (251006 => 251007)
--- trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.cpp 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.cpp 2019-10-11 14:18:01 UTC (rev 251007)
@@ -35,8 +35,8 @@
WTF_MAKE_ISO_ALLOCATED_IMPL(OfflineAudioContext);
-inline OfflineAudioContext::OfflineAudioContext(Document& document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
- : AudioContext(document, numberOfChannels, numberOfFrames, sampleRate)
+inline OfflineAudioContext::OfflineAudioContext(Document& document, AudioBuffer* renderTarget)
+ : AudioContext(document, renderTarget)
{
}
@@ -47,7 +47,11 @@
return Exception { NotSupportedError };
if (!numberOfChannels || numberOfChannels > 10 || !numberOfFrames || !isSampleRateRangeGood(sampleRate))
return Exception { SyntaxError };
- auto audioContext = adoptRef(*new OfflineAudioContext(downcast<Document>(context), numberOfChannels, numberOfFrames, sampleRate));
+ auto renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
+ if (!renderTarget)
+ return Exception { SyntaxError };
+
+ auto audioContext = adoptRef(*new OfflineAudioContext(downcast<Document>(context), renderTarget.get()));
audioContext->suspendIfNeeded();
return audioContext;
}
Modified: trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.h (251006 => 251007)
--- trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.h 2019-10-11 11:37:39 UTC (rev 251006)
+++ trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.h 2019-10-11 14:18:01 UTC (rev 251007)
@@ -34,7 +34,7 @@
static ExceptionOr<Ref<OfflineAudioContext>> create(ScriptExecutionContext&, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate);
private:
- OfflineAudioContext(Document&, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate);
+ OfflineAudioContext(Document&, AudioBuffer* renderTarget);
};
} // namespace WebCore
