Changeset 236256 in webkit

Timestamp:

Sep 20, 2018, 4:22:00 AM (8 years ago)

Author:

commit-queue@webkit.org

Message:

[EME] Add WebM sanitization
​https://bugs.webkit.org/show_bug.cgi?id=189740

Patch by Yacine Bandou <​yacine.bandou@softathome.com> on 2018-09-20
Reviewed by Xabier Rodriguez-Calvar.

This patch adds support for sanitizing the WebM initialization data,
ensures there are no bogus values.
See ​https://www.w3.org/TR/encrypted-media/#dom-mediakeysession-generaterequest.

Tests: imported/w3c/web-platform-tests/encrypted-media/clearkey-generate-request-disallowed-input.https.html

• Modules/encryptedmedia/InitDataRegistry.cpp:

(WebCore::sanitizeWebM): Added implementation, check if the initialization data doesn't empty and its size
should be less than 64KB, return the buffer copy if it is ok, otherwise a nullptr.
(WebCore::extractKeyIDsWebM): Added implementation.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/encryptedmedia/InitDataRegistry.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-09-20  Yacine Bandou  <yacine.bandou@softathome.com>
+
+        [EME] Add WebM sanitization
+        https://bugs.webkit.org/show_bug.cgi?id=189740
+
+        Reviewed by Xabier Rodriguez-Calvar.
+
+        This patch adds support for sanitizing the WebM initialization data,
+        ensures there are no bogus values.
+        See https://www.w3.org/TR/encrypted-media/#dom-mediakeysession-generaterequest.
+
+        Tests: imported/w3c/web-platform-tests/encrypted-media/clearkey-generate-request-disallowed-input.https.html
+
+        * Modules/encryptedmedia/InitDataRegistry.cpp:
+        (WebCore::sanitizeWebM): Added implementation, check if the initialization data doesn't empty and its size
+        should be less than 64KB, return the buffer copy if it is ok, otherwise a nullptr.
+        (WebCore::extractKeyIDsWebM): Added implementation.
+
 2018-09-20  Philippe Normand  <pnormand@igalia.com>
 

trunk/Source/WebCore/Modules/encryptedmedia/InitDataRegistry.cpp

@@ -42 +42 @@
 namespace {
     const uint32_t kCencMaxBoxSize = 64 * KB;
+    // ContentEncKeyID has this EBML code [47][E2] in WebM,
+    // as per spec the size of the ContentEncKeyID is encoded on 16 bits.
+    // https://matroska.org/technical/specs/index.html#ContentEncKeyID/
+    const uint32_t kWebMMaxContentEncKeyIDSize = 64 * KB; // 2^16
 }
 
@@ -140 +144 @@
 static RefPtr<SharedBuffer> sanitizeWebM(const SharedBuffer& buffer)
 {
+    // Check if the buffer is a valid WebM initData.
+    // The WebM initData is the ContentEncKeyID, so should be less than kWebMMaxContentEncKeyIDSize.
+    if (buffer.isEmpty() || buffer.size() > kWebMMaxContentEncKeyIDSize)
+        return nullptr;
+
+    return buffer.copy();
+}
+
+static std::optional<Vector<Ref<SharedBuffer>>> extractKeyIDsWebM(const SharedBuffer& buffer)
+{
+    Vector<Ref<SharedBuffer>> keyIDs;
+    RefPtr<SharedBuffer> sanitazedBuffer = sanitizeWebM(buffer);
+    if (!sanitazedBuffer)
+        return std::nullopt;
+
     // 1. Format
     // https://w3c.github.io/encrypted-media/format-registry/initdata/webm.html#format
-    notImplemented();
-    return buffer.copy();
-}
-
-static std::optional<Vector<Ref<SharedBuffer>>> extractKeyIDsWebM(const SharedBuffer&)
-{
-    // 1. Format
-    // https://w3c.github.io/encrypted-media/format-registry/initdata/webm.html#format
-    notImplemented();
-    return std::nullopt;
+    keyIDs.append(sanitazedBuffer.releaseNonNull());
+    return keyIDs;
 }