Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 49e046b1a9fbd2729e709c7da5a227e849b397bb
https://github.com/WebKit/WebKit/commit/49e046b1a9fbd2729e709c7da5a227e849b397bb
Author: Chris Dumez <[email protected]>
Date: 2026-09-18 (Fri, 18 Sep 2026)
Changed paths:
M Source/WebCore/platform/audio/cocoa/CARingBuffer.h
M Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSource.cpp
M Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSource.h
M
Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.cpp
Log Message:
-----------
Validate numberOfFrames in
SpeechRecognitionRemoteRealtimeMediaSourceManager::remoteAudioSamplesAvailable
https://bugs.webkit.org/show_bug.cgi?id=320175
rdar://183111028
Reviewed by Jean-Yves Avenard.
remoteAudioSamplesAvailable() received numberOfFrames from the (untrusted)
WebContent process and used it to size an audio buffer in the UI process
(via WebAudioBufferList::setSampleCount()), which only guards against
arithmetic overflow, not against merely-large values. A compromised WebContent
process could therefore trigger an unbounded allocation in the UI process.
Validate the message: reject it unless the source's shared ring buffer has been
mapped and numberOfFrames is non-zero and no larger than that buffer's capacity.
The producing process had to actually allocate shared memory for that capacity,
so this removes the amplification. Add CARingBuffer::frameCount() and
SpeechRecognitionRemoteRealtimeMediaSource::audioBufferFrameCount() to expose
the bound to the message receiver.
* Source/WebCore/platform/audio/cocoa/CARingBuffer.h:
(WebCore::CARingBuffer::frameCount const):
* Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSource.cpp:
(WebKit::SpeechRecognitionRemoteRealtimeMediaSource::audioBufferFrameCount
const):
* Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSource.h:
* Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.cpp:
(WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager::remoteAudioSamplesAvailable):
Originally-landed-as: 316606.245@safari-7625-branch (1d7dfd5f55aa).
rdar://187506592
Canonical link: https://commits.webkit.org/321421@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
