Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 6c4fdcaba1fb630ac5f7819bf1e46c59f486f8de
https://github.com/WebKit/WebKit/commit/6c4fdcaba1fb630ac5f7819bf1e46c59f486f8de
Author: Jean-Yves Avenard <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A
LayoutTests/ipc/display-capture-source-configuration-change-uaf-expected.txt
A LayoutTests/ipc/display-capture-source-configuration-change-uaf.html
M Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp
Log Message:
-----------
Cherry-pick [email protected] (a06fd51c1706).
https://bugs.webkit.org/show_bug.cgi?id=318405
[CoreIPC][GPUP] UserMediaCaptureManagerProxySourceProxy can leave a
dangling VideoFrameObserver* in RealtimeMediaSource
rdar://174702504
Reviewed by Jer Noble.
UserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged()
re-registers
the proxy as a VideoFrameObserver of its RealtimeMediaSource via
removeVideoFrameObserver()/addVideoFrameObserver() without consulting
m_isObservingMedia.
Since the proxy is registered as a RealtimeMediaSourceObserver
unconditionally in its
constructor, this callback can fire on a stopped (or never-started) proxy
and insert a
raw VideoFrameObserver* into m_videoFrameObservers while m_isObservingMedia
remains
false. The destructor's unobserveMedia() then early-returns without
removing the entry.
DisplayCaptureSourceCocoa does not override clone(), so
UserMediaCaptureManagerProxy::clone()
yields two proxies sharing the same RealtimeMediaSource; the surviving
clone keeps the
source (and its dangling raw key) alive after the first proxy is freed, and
the next
videoFrameAvailable() virtual-dispatches through freed memory in the GPU
process. This
is reachable from a compromised WebContent process over
UserMediaCaptureManagerProxy IPC
once the page has been granted getDisplayMedia.
Guard the observer re-registration in sourceConfigurationChanged() on
m_isObservingMedia
so a stopped proxy is never re-inserted into m_videoFrameObservers.
*
LayoutTests/ipc/display-capture-source-configuration-change-uaf-expected.txt:
Added.
* LayoutTests/ipc/display-capture-source-configuration-change-uaf.html:
Added.
* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:
(WebKit::UserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.247@webkitglib/2.54
Commit: 6507c86e90f991da609f062b8362bd74b8c1fc04
https://github.com/WebKit/WebKit/commit/6507c86e90f991da609f062b8362bd74b8c1fc04
Author: Jean-Yves Avenard <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash-expected.txt
A
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash.html
M Source/WebCore/Modules/mediasource/SampleMap.cpp
M Source/WebCore/platform/graphics/cocoa/SourceBufferParserWebM.cpp
M Tools/TestWebKitAPI/Tests/WebCore/SampleMap.cpp
Log Message:
-----------
Cherry-pick [email protected] (bd4c91c57d10).
https://bugs.webkit.org/show_bug.cgi?id=318480
Malformed WebM with non-monotonically increasing presentation timestamps
can cause a crash.
rdar://177494050
Reviewed by Eric Carlson.
We guard against non-monotonically increasing presentation timestamps in
SourceBufferParserWebM
and SampleMap
Tests: media/media-source/media-source-webm-reversed-timestamps-crash.html
Tools/TestWebKitAPI/Tests/WebCore/SampleMap.cpp
*
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash-expected.txt:
Added.
*
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash.html:
Added.
* Source/WebCore/Modules/mediasource/SampleMap.cpp:
(WebCore::PresentationOrderSampleMap::findSamplesBetweenPresentationTimes):
(WebCore::PresentationOrderSampleMap::findSamplesBetweenPresentationTimesFromEnd):
* Source/WebCore/platform/graphics/cocoa/SourceBufferParserWebM.cpp:
(WebCore::WebMParser::VideoTrackData::processPendingMediaSamples):
* Tools/TestWebKitAPI/Tests/WebCore/SampleMap.cpp:
(TestWebKitAPI::TEST_F(SampleMapTest, findSamplesBetweenPresentationTimes)):
(TestWebKitAPI::TEST_F(SampleMapTest,
findSamplesBetweenPresentationTimesFromEnd)):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.248@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/1caaf445d257...6507c86e90f9
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
