Changeset 259662 in webkit

Timestamp:

Apr 7, 2020, 1:03:14 PM (6 years ago)

Author:

Alan Coon

Message:

Apply patch. rdar://problem/61231881

Location:

branches/safari-609.2.1.2-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/ios/WebPageProxyIOS.mm (modified) (2 diffs)

branches/safari-609.2.1.2-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-07  Russell Epstein  <repstein@apple.com>
+
+        Apply patch. rdar://problem/61231881
+
+    2020-04-07  David Kilzer  <ddkilzer@apple.com>
+
+            Cherry-pick r258374. rdar://problem/60396281
+
+        2020-03-12  David Kilzer  <ddkilzer@apple.com>
+
+            WebPageProxy::SaveImageToLibrary should validate its `imageSize` parameter
+            <https://webkit.org/b/209012>
+            <rdar://problem/60181295>
+
+            Reviewed by Chris Dumez.
+
+            * UIProcess/ios/WebPageProxyIOS.mm:
+            (WebKit::WebPageProxy::saveImageToLibrary):
+            - Validate upper bound of `imageSize` parameter.
+            - Add static_cast<size_t>() to `imageSize` parameter to denote
+              type change.
+
 2020-04-07  Alan Coon  <alancoon@apple.com>
 

branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm

@@ -648 +648 @@
 {
     MESSAGE_CHECK(!imageHandle.isNull());
-    MESSAGE_CHECK(imageSize);
+    // SharedMemory::Handle::size() is rounded up to the nearest page.
+    MESSAGE_CHECK(imageSize && imageSize <= imageHandle.size());
 
     auto sharedMemoryBuffer = SharedMemory::map(imageHandle, SharedMemory::Protection::ReadOnly);
@@ -654 +655 @@
         return;
 
-    auto buffer = SharedBuffer::create(static_cast<unsigned char*>(sharedMemoryBuffer->data()), imageSize);
+    auto buffer = SharedBuffer::create(static_cast<unsigned char*>(sharedMemoryBuffer->data()), static_cast<size_t>(imageSize));
     pageClient().saveImageToLibrary(WTFMove(buffer));
 }