Changeset 232451 in webkit

Timestamp:

Jun 3, 2018, 11:28:07 AM (8 years ago)

Author:

Brent Fulgham

Message:

Make sure that the fencePort received over IPC has the expected disposition (SEND)
​https://bugs.webkit.org/show_bug.cgi?id=186211
<rdar://problem/37814171>

Reviewed by Geoffrey Garen.

It is possible (though very unlikely) for a message to be recevied that has the wrong mach port disposition.
If this happens, we shouldn't manipulate the passed mach_port_t or pass it on to other API. We already
drop messages that violate this expectation in the IPC layer, but code handling IPC::Attachment data types
are not checking this value.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::setTopContentInsetFenced):

• WebProcess/cocoa/VideoFullscreenManager.mm:

(WebKit::VideoFullscreenManager::setVideoLayerFrameFenced):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/WebPage.cpp (modified) (1 diff)
• WebProcess/cocoa/VideoFullscreenManager.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-06-03  Brent Fulgham  <bfulgham@apple.com>
+
+        Make sure that the fencePort received over IPC has the expected disposition (SEND)
+        https://bugs.webkit.org/show_bug.cgi?id=186211
+        <rdar://problem/37814171>
+
+        Reviewed by Geoffrey Garen.
+
+        It is possible (though very unlikely) for a message to be recevied that has the wrong mach port disposition.
+        If this happens, we shouldn't manipulate the passed mach_port_t or pass it on to other API. We already
+        drop messages that violate this expectation in the IPC layer, but code handling IPC::Attachment data types
+        are not checking this value.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setTopContentInsetFenced):
+        * WebProcess/cocoa/VideoFullscreenManager.mm:
+        (WebKit::VideoFullscreenManager::setVideoLayerFrameFenced):
+
 2018-06-02  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

@@ -2666 +2666 @@
 void WebPage::setTopContentInsetFenced(float contentInset, IPC::Attachment fencePort)
 {
+    if (fencePort.disposition() != MACH_MSG_TYPE_MOVE_SEND) {
+        LOG(Layers, "WebPage::setTopContentInsetFenced(%g, fencePort) Received an invalid fence port: %d, disposition: %d", contentInset, fencePort.port(), fencePort.disposition());
+        return;
+    }
+
     m_drawingArea->addFence(MachSendRight::create(fencePort.port()));
 

trunk/Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm

@@ -565 +565 @@
     LOG(Fullscreen, "VideoFullscreenManager::setVideoLayerFrameFenced(%p, %x)", this, contextId);
 
+    if (fencePort.disposition() != MACH_MSG_TYPE_MOVE_SEND) {
+        LOG(Fullscreen, "VideoFullscreenManager::setVideoLayerFrameFenced(%p, %x) Received an invalid fence port: %d, disposition: %d", this, contextId, fencePort.port(), fencePort.disposition());
+        return;
+    }
+
     RefPtr<VideoFullscreenModelVideoElement> model;
     RefPtr<VideoFullscreenInterfaceContext> interface;
@@ -574 +579 @@
     }
     
-    if (interface->layerHostingContext())
-        interface->layerHostingContext()->setFencePort(fencePort.port());
+    if (auto* context = interface->layerHostingContext())
+        context->setFencePort(fencePort.port());
     model->setVideoLayerFrame(bounds);
     deallocateSendRightSafely(fencePort.port());