Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: d6b2593451de1ee863e109f40c70001eca2f5e83
https://github.com/WebKit/WebKit/commit/d6b2593451de1ee863e109f40c70001eca2f5e83
Author: Youenn Fablet <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A LayoutTests/webrtc/script-transform-av1-large-obu-crash-expected.txt
A LayoutTests/webrtc/script-transform-av1-large-obu-crash-worker.js
A LayoutTests/webrtc/script-transform-av1-large-obu-crash.html
M
Source/ThirdParty/libwebrtc/Source/webrtc/modules/rtp_rtcp/source/rtp_packetizer_av1.cc
Log Message:
-----------
Cherry-pick [email protected] (ffec8ee666a1).
https://bugs.webkit.org/show_bug.cgi?id=317270
int truncation of OBU size in RtpPacketizerAv1::ParseObus
rdar://177214855
Reviewed by Eric Carlson.
Obu::size and Packet::packet_size are signed 32-bit while OBU payload
lengths are size_t.
ParseObus adds obu.payload.size() into obu.size, which wraps negative for
an OBU >= 2 GiB.
PacketizeInternal then accepts the negative size as fitting into a single
packet and computes a small packet_size,
but NextPacket allocates the RTP buffer from that truncated value and
memcpy() the untruncated size_t payload, writing past the CopyOnWriteBuffer.
This is reachable via a RTCRtpScriptTransform creating a big AV1 data
buffer.
The fix is to reject the frame in ParseObus when an OBU payload would
overflow Obu::size, matching the existing handling for other malformed inputs.
Patch written with Simon Lewis.
Test: webrtc/script-transform-av1-large-obu-crash.html
* LayoutTests/webrtc/script-transform-av1-large-obu-crash-expected.txt:
Added.
* LayoutTests/webrtc/script-transform-av1-large-obu-crash-worker.js: Added.
(onrtctransform.event.pump):
* LayoutTests/webrtc/script-transform-av1-large-obu-crash.html: Added.
*
Source/ThirdParty/libwebrtc/Source/webrtc/modules/rtp_rtcp/source/rtp_packetizer_av1.cc:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.302@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
