Changeset 259661 in webkit

Timestamp:

Apr 7, 2020, 1:03:10 PM (6 years ago)

Author:

Alan Coon

Message:

Apply patch. rdar://problem/61404555

Location:

branches/safari-609.2.1.2-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/ios/WebPageProxyIOS.mm (modified) (3 diffs)

branches/safari-609.2.1.2-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-07  Alan Coon  <alancoon@apple.com>
+
+        Apply patch. rdar://problem/61404555
+
+    2020-04-07  David Kilzer  <ddkilzer@apple.com>
+
+            Cherry-pick r258053. rdar://problem/60430195
+
+        2020-03-06  David Kilzer  <ddkilzer@apple.com>
+
+            IPC hardening for WebPageProxy::SaveImageToLibrary message
+            <https://webkit.org/b/208730>
+            <rdar://problem/58700693>
+
+            Reviewed by Chris Dumez.
+
+            * UIProcess/ios/WebPageProxyIOS.mm:
+            (MESSAGE_CHECK): Define macro only for methods in this source file.
+            (WebKit::WebPageProxy::saveImageToLibrary):
+            - Make sure the shared memory handle sent over IPC is not null.
+            - Make sure the image size sent over IPC is not zero.
+            - Null check the SharedMemory object after calling
+              SharedMemory::map().
+
 2020-04-03  Alan Coon  <alancoon@apple.com>
 

branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm

@@ -77 +77 @@
 #endif
 
+#define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, process().connection())
+
 #define RELEASE_LOG_IF_ALLOWED(channel, fmt, ...) RELEASE_LOG_IF(isAlwaysOnLoggingAllowed(), channel, "%p - [pageProxyID=%llu, webPageID=%llu, PID=%i] WebPageProxy::" fmt, this, m_identifier.toUInt64(), m_webPageID.toUInt64(), m_process->processIdentifier(), ##__VA_ARGS__)
 
@@ -645 +647 @@
 void WebPageProxy::saveImageToLibrary(const SharedMemory::Handle& imageHandle, uint64_t imageSize)
 {
+    MESSAGE_CHECK(!imageHandle.isNull());
+    MESSAGE_CHECK(imageSize);
+
     auto sharedMemoryBuffer = SharedMemory::map(imageHandle, SharedMemory::Protection::ReadOnly);
+    if (!sharedMemoryBuffer)
+        return;
+
     auto buffer = SharedBuffer::create(static_cast<unsigned char*>(sharedMemoryBuffer->data()), imageSize);
     pageClient().saveImageToLibrary(WTFMove(buffer));
@@ -1500 +1508 @@
 
 #undef RELEASE_LOG_IF_ALLOWED
+#undef MESSAGE_CHECK
 
 #endif // PLATFORM(IOS_FAMILY)