Changeset 214618 in webkit

Timestamp:

Mar 30, 2017 1:17:08 PM (7 years ago)

Author:

eric.carlson@apple.com

Message:

[Crash] WebCore::AudioBuffer::AudioBuffer don't checking illegal value
​https://bugs.webkit.org/show_bug.cgi?id=169956

Reviewed by Youenn Fablet.

Source/WebCore:

Test: webaudio/audiobuffer-crash.html

• Modules/webaudio/AudioBuffer.cpp:

(WebCore::AudioBuffer::AudioBuffer): Invalidate the object and return early if the channel
array allocation fails.
(WebCore::AudioBuffer::AudioBuffer): Ditto.
(WebCore::AudioBuffer::invalidate): Invalidate the object.

• Modules/webaudio/AudioBuffer.h:

LayoutTests:

• webaudio/audiobuffer-crash-expected.txt: Added.
• webaudio/audiobuffer-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/webaudio/audiobuffer-crash-expected.txt (added)
• LayoutTests/webaudio/audiobuffer-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/Modules/webaudio/AudioBuffer.cpp (modified) (3 diffs)
• Source/WebCore/Modules/webaudio/AudioBuffer.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-03-30  Eric Carlson  <eric.carlson@apple.com>
+
+        [Crash] WebCore::AudioBuffer::AudioBuffer don't checking illegal value
+        https://bugs.webkit.org/show_bug.cgi?id=169956
+
+        Reviewed by Youenn Fablet.
+
+        * webaudio/audiobuffer-crash-expected.txt: Added.
+        * webaudio/audiobuffer-crash.html: Added.
+
 2017-03-30  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-03-30  Eric Carlson  <eric.carlson@apple.com>
+
+        [Crash] WebCore::AudioBuffer::AudioBuffer don't checking illegal value
+        https://bugs.webkit.org/show_bug.cgi?id=169956
+
+        Reviewed by Youenn Fablet.
+
+        Test: webaudio/audiobuffer-crash.html
+
+        * Modules/webaudio/AudioBuffer.cpp:
+        (WebCore::AudioBuffer::AudioBuffer): Invalidate the object and return early if the channel 
+        array allocation fails.
+        (WebCore::AudioBuffer::AudioBuffer): Ditto.
+        (WebCore::AudioBuffer::invalidate): Invalidate the object.
+        * Modules/webaudio/AudioBuffer.h:
+
 2017-03-30  Antoine Quint  <graouts@apple.com>
 

trunk/Source/WebCore/Modules/webaudio/AudioBuffer.cpp

@@ -44 +44 @@
     if (sampleRate < 22050 || sampleRate > 96000 || numberOfChannels > AudioContext::maxNumberOfChannels() || !numberOfFrames)
         return nullptr;
-    return adoptRef(*new AudioBuffer(numberOfChannels, numberOfFrames, sampleRate));
+
+    auto buffer = adoptRef(*new AudioBuffer(numberOfChannels, numberOfFrames, sampleRate));
+    if (!buffer->m_length)
+        return nullptr;
+
+    return WTFMove(buffer);
 }
 
@@ -62 +67 @@
 
     for (unsigned i = 0; i < numberOfChannels; ++i) {
-        RefPtr<Float32Array> channelDataArray = Float32Array::create(m_length);
+        auto channelDataArray = Float32Array::create(m_length);
+        if (!channelDataArray) {
+            invalidate();
+            break;
+        }
+
         channelDataArray->setNeuterable(false);
-        m_channels.append(channelDataArray);
+        m_channels.append(WTFMove(channelDataArray));
     }
 }
@@ -77 +87 @@
     for (unsigned i = 0; i < numberOfChannels; ++i) {
         auto channelDataArray = Float32Array::create(m_length);
+        if (!channelDataArray) {
+            invalidate();
+            break;
+        }
+
         channelDataArray->setNeuterable(false);
         channelDataArray->setRange(bus.channel(i)->data(), m_length, 0);
         m_channels.append(WTFMove(channelDataArray));
     }
+}
+
+void AudioBuffer::invalidate()
+{
+    releaseMemory();
+    m_length = 0;
 }
 

trunk/Source/WebCore/Modules/webaudio/AudioBuffer.h

@@ -70 +70 @@
     explicit AudioBuffer(AudioBus&);
 
+    void invalidate();
+
     double m_gain { 1.0 }; // scalar gain
     float m_sampleRate;