Changeset 259663 in webkit

Timestamp:

Apr 7, 2020, 1:03:17 PM (6 years ago)

Author:

Alan Coon

Message:

Apply patch. rdar://problem/61231889

Location:

branches/safari-609.2.1.2-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/Connection.h (modified) (1 diff)
• UIProcess/mac/WebPageProxyMac.mm (modified) (3 diffs)

branches/safari-609.2.1.2-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-07  Alan Coon  <alancoon@apple.com>
+
+        Apply patch. rdar://problem/61231889
+
+    2020-04-07  David Kilzer  <ddkilzer@apple.com>
+
+            Cherry-pick r258507. rdar://problem/60500511
+
+        2020-03-16  David Kilzer  <ddkilzer@apple.com>
+
+            WebPage::GetDataSelectionForPasteboard should validate its `size` variable
+            <https://webkit.org/b/209092>
+            <rdar://problem/60181345>
+
+            Reviewed by Brent Fulgham.
+
+            * Platform/IPC/Connection.h:
+            (MESSAGE_CHECK_WITH_RETURN_VALUE_BASE): Add.
+            - Variant of MESSAGE_CHECK_BASE() that takes a return value.
+            * UIProcess/mac/WebPageProxyMac.mm:
+            (MESSAGE_CHECK_WITH_RETURN_VALUE): Add.
+            (WebKit::WebPageProxy::dataSelectionForPasteboard):
+            - Use new MESSAGE_CHECK_WITH_RETURN_VALUE() macro to update
+              check for handle.isNull() and to add check for `size`
+              variable.
+            - Add static_cast<size_t>() to `size` variable to denote type
+              change.
+
 2020-04-07  Russell Epstein  <repstein@apple.com>
 

branches/safari-609.2.1.2-branch/Source/WebKit/Platform/IPC/Connection.h

@@ -85 +85 @@
 while (0)
 
+#define MESSAGE_CHECK_WITH_RETURN_VALUE_BASE(assertion, connection, returnValue) do \
+    if (!(assertion)) { \
+        ASSERT(assertion); \
+        (connection)->markCurrentlyDispatchedMessageAsInvalid(); \
+        return (returnValue); \
+    } \
+while (0)
+
 template<typename AsyncReplyResult> struct AsyncReplyError {
     static AsyncReplyResult create() { return { }; };

branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/mac/WebPageProxyMac.mm

@@ -32 +32 @@
 #import "AttributedString.h"
 #import "ColorSpaceData.h"
+#import "Connection.h"
 #import "DataReference.h"
 #import "EditorState.h"
@@ -68 +69 @@
 #define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, process().connection())
 #define MESSAGE_CHECK_URL(url) MESSAGE_CHECK_BASE(checkURLReceivedFromCurrentOrPreviousWebProcess(m_process, url), m_process->connection())
+#define MESSAGE_CHECK_WITH_RETURN_VALUE(assertion, returnValue) MESSAGE_CHECK_WITH_RETURN_VALUE_BASE(assertion, process().connection(), returnValue)
 
 @interface NSApplication ()
@@ -284 +286 @@
     process().sendSync(Messages::WebPage::GetDataSelectionForPasteboard(pasteboardType),
         Messages::WebPage::GetDataSelectionForPasteboard::Reply(handle, size), m_webPageID, messageTimeout);
-    if (handle.isNull())
-        return nullptr;
-    RefPtr<SharedMemory> sharedMemoryBuffer = SharedMemory::map(handle, SharedMemory::Protection::ReadOnly);
-    return SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), size);
+    MESSAGE_CHECK_WITH_RETURN_VALUE(!handle.isNull(), nullptr);
+    // SharedMemory::Handle::size() is rounded up to the nearest page.
+    MESSAGE_CHECK_WITH_RETURN_VALUE(size <= handle.size(), nullptr);
+
+    auto sharedMemoryBuffer = SharedMemory::map(handle, SharedMemory::Protection::ReadOnly);
+    return SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), static_cast<size_t>(size));
 }