Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 73617b471a7042c5208d81462dd3f8a9f724c500
https://github.com/WebKit/WebKit/commit/73617b471a7042c5208d81462dd3f8a9f724c500
Author: Kristian Monsen <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A
LayoutTests/ipc/cocoa/LocalSampleBufferDisplayLayer-non-finite-bounds-crash-expected.txt
A
LayoutTests/ipc/cocoa/LocalSampleBufferDisplayLayer-non-finite-bounds-crash.html
M
Source/WebCore/platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm
Log Message:
-----------
[GPU Process] Non-finite bounds in
UpdateSampleBufferDisplayLayerBoundsAndPosition raise CALayerInvalidGeometry
and terminate the GPU process
https://bugs.webkit.org/show_bug.cgi?id=324085
rdar://187001248
Reviewed by Matt Woodrow.
CALayer raises CALayerInvalidGeometry for non-finite geometry, and nothing in
the GPU process' IPC
dispatch path catches Objective-C exceptions, so the raise terminates the
process. Validate the
bounds with std::isfinite before they reach CALayer and drop them if they are
non-finite, falling
back to the existing transform-only path as if no explicit bounds had been
supplied. Also clamp
the layer size passed to initialize(), which is likewise attacker-controlled
and unbounded.
Test: ipc/cocoa/LocalSampleBufferDisplayLayer-non-finite-bounds-crash.html
*
LayoutTests/ipc/cocoa/LocalSampleBufferDisplayLayer-non-finite-bounds-crash-expected.txt:
Added.
*
LayoutTests/ipc/cocoa/LocalSampleBufferDisplayLayer-non-finite-bounds-crash.html:
Added.
*
Source/WebCore/platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm:
(WebCore::isValidLayerGeometry):
(WebCore::LocalSampleBufferDisplayLayer::initialize):
(WebCore::LocalSampleBufferDisplayLayer::updateSampleLayerBoundsAndPosition):
Canonical link: https://commits.webkit.org/321132@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
