⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 251007 in webkit


Ignore:
Timestamp:
Oct 11, 2019, 7:18:01 AM (7 years ago)
Author:
commit-queue@webkit.org
Message:

OfflineAudioContext does not validate allocation of destination buffer
​https://bugs.webkit.org/show_bug.cgi?id=177259

Patch by Bjorn Melinder <​bjornm@spotify.com> on 2019-10-11
Reviewed by Eric Carlson.

Moved the allocation of the destination buffer to the static
OfflineAudioContext::create method where we are able to handle a failed
allocation properly and return an Exception. This change handles both
negative lengths as well as too large lengths where the memory cannot
be allocated.

Source/WebCore:

  • Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::AudioContext):

  • Modules/webaudio/AudioContext.h:
  • Modules/webaudio/OfflineAudioContext.cpp:

(WebCore::OfflineAudioContext::OfflineAudioContext):
(WebCore::OfflineAudioContext::create):

  • Modules/webaudio/OfflineAudioContext.h:

LayoutTests:

  • webaudio/offlineaudiocontext-constructor-expected.txt:
  • webaudio/offlineaudiocontext-constructor.html:
Location:
trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r251006 r251007  
     12019-10-11  Bjorn Melinder  <bjornm@spotify.com>
     2
     3        OfflineAudioContext does not validate allocation of destination buffer
     4        https://bugs.webkit.org/show_bug.cgi?id=177259
     5
     6        Reviewed by Eric Carlson.
     7
     8        Moved the allocation of the destination buffer to the static
     9        OfflineAudioContext::create method where we are able to handle a failed
     10        allocation properly and return an Exception. This change handles both
     11        negative lengths as well as too large lengths where the memory cannot
     12        be allocated.
     13
     14        * webaudio/offlineaudiocontext-constructor-expected.txt:
     15        * webaudio/offlineaudiocontext-constructor.html:
     16
    1172019-10-11  Chris Lord  <clord@igalia.com>
    218

  • trunk/LayoutTests/webaudio/offlineaudiocontext-constructor-expected.txt

    r219663 r251007  
    55
    66PASS new webkitOfflineAudioContext(1, 0, 44100) threw exception SyntaxError: The string did not match the expected pattern..
     7PASS new webkitOfflineAudioContext(1, -1, 44100) threw exception SyntaxError: The string did not match the expected pattern..
     8PASS new webkitOfflineAudioContext(1, 99999999999, 44100) threw exception SyntaxError: The string did not match the expected pattern..
    79PASS new webkitOfflineAudioContext(0, 1, 44100) threw exception SyntaxError: The string did not match the expected pattern..
    810PASS new webkitOfflineAudioContext(1, 1, 0) threw exception SyntaxError: The string did not match the expected pattern..

  • trunk/LayoutTests/webaudio/offlineaudiocontext-constructor.html

    r179565 r251007  
    77            description('This tests that passing zero to the "numberOfFrames" parameter of the OfflineAudioContext constructor does not cause a crash.');
    88            shouldThrow('new webkitOfflineAudioContext(1, 0, 44100)');
     9            shouldThrow('new webkitOfflineAudioContext(1, -1, 44100)');
     10            shouldThrow('new webkitOfflineAudioContext(1, 99999999999, 44100)');
    911            shouldThrow('new webkitOfflineAudioContext(0, 1, 44100)');
    1012            shouldThrow('new webkitOfflineAudioContext(1, 1, 0)');

  • trunk/Source/WebCore/ChangeLog

    r251000 r251007  
     12019-10-11  Bjorn Melinder  <bjornm@spotify.com>
     2
     3        OfflineAudioContext does not validate allocation of destination buffer
     4        https://bugs.webkit.org/show_bug.cgi?id=177259
     5
     6        Reviewed by Eric Carlson.
     7
     8        Moved the allocation of the destination buffer to the static
     9        OfflineAudioContext::create method where we are able to handle a failed
     10        allocation properly and return an Exception. This change handles both
     11        negative lengths as well as too large lengths where the memory cannot
     12        be allocated.
     13
     14        * Modules/webaudio/AudioContext.cpp:
     15        (WebCore::AudioContext::AudioContext):
     16        * Modules/webaudio/AudioContext.h:
     17        * Modules/webaudio/OfflineAudioContext.cpp:
     18        (WebCore::OfflineAudioContext::OfflineAudioContext):
     19        (WebCore::OfflineAudioContext::create):
     20        * Modules/webaudio/OfflineAudioContext.h:
     21
    1222019-10-10  Konstantin Tokarev  <annulen@yandex.ru>
    223

  • trunk/Source/WebCore/Modules/webaudio/AudioContext.cpp

    r250542 r251007  
    159159
    160160// Constructor for offline (non-realtime) rendering.
    161 AudioContext::AudioContext(Document& document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
     161AudioContext::AudioContext(Document& document, AudioBuffer* renderTarget)
    162162    : ActiveDOMObject(document)
    163163#if !RELEASE_LOG_DISABLED
    … …  
    168168    , m_mediaSession(PlatformMediaSession::create(*this))
    169169    , m_eventQueue(MainThreadGenericEventQueue::create(*this))
     170    , m_renderTarget(renderTarget)
    170171{
    171172    constructCommon();
    172173
    173174    // Create a new destination for offline rendering.
    174     m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
    175175    m_destinationNode = OfflineAudioDestinationNode::create(*this, m_renderTarget.get());
    176176}

  • trunk/Source/WebCore/Modules/webaudio/AudioContext.h

    r250735 r251007  
    297297protected:
    298298    explicit AudioContext(Document&);
    299     AudioContext(Document&, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate);
     299    AudioContext(Document&, AudioBuffer* renderTarget);
    300300   
    301301    static bool isSampleRateRangeGood(float sampleRate);

  • trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.cpp

    r243887 r251007  
    3636WTF_MAKE_ISO_ALLOCATED_IMPL(OfflineAudioContext);
    3737
    38 inline OfflineAudioContext::OfflineAudioContext(Document& document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
    39     : AudioContext(document, numberOfChannels, numberOfFrames, sampleRate)
     38inline OfflineAudioContext::OfflineAudioContext(Document& document, AudioBuffer* renderTarget)
     39    : AudioContext(document, renderTarget)
    4040{
    4141}
    … …  
    4848    if (!numberOfChannels || numberOfChannels > 10 || !numberOfFrames || !isSampleRateRangeGood(sampleRate))
    4949        return Exception { SyntaxError };
    50     auto audioContext = adoptRef(*new OfflineAudioContext(downcast<Document>(context), numberOfChannels, numberOfFrames, sampleRate));
     50    auto renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
     51    if (!renderTarget)
     52        return Exception { SyntaxError };
     53
     54    auto audioContext = adoptRef(*new OfflineAudioContext(downcast<Document>(context), renderTarget.get()));
    5155    audioContext->suspendIfNeeded();
    5256    return audioContext;

  • trunk/Source/WebCore/Modules/webaudio/OfflineAudioContext.h

    r243887 r251007  
    3535
    3636private:
    37     OfflineAudioContext(Document&, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate);
     37    OfflineAudioContext(Document&, AudioBuffer* renderTarget);
    3838};
    3939
Note: See TracChangeset for help on using the changeset viewer.