Changeset 259664 in webkit

Timestamp:

Apr 7, 2020, 1:03:20 PM (6 years ago)

Author:

Alan Coon

Message:

Apply patch. rdar://problem/61231957

Location:

branches/safari-609.2.1.2-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/Connection.h (modified) (1 diff)
• Platform/SharedMemory.h (modified) (1 diff)
• UIProcess/Cocoa/WebPasteboardProxyCocoa.mm (modified) (4 diffs)
• UIProcess/WebPasteboardProxy.h (modified) (1 diff)
• UIProcess/WebPasteboardProxy.messages.in (modified) (1 diff)

branches/safari-609.2.1.2-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-07  Russell Epstein  <repstein@apple.com>
+
+        Apply patch. rdar://problem/61231957
+
+    2020-04-07  David Kilzer  <ddkilzer@apple.com>
+
+            Cherry-pick r258334. rdar://problem/60396294
+
+        2020-03-12  David Kilzer  <ddkilzer@apple.com>
+
+            WebPasteboardProxy::SetPasteboardBufferForType should validate its `size` parameter
+            <https://webkit.org/b/208902>
+            <rdar://problem/60181117>
+
+            Reviewed by Chris Dumez.
+
+            * Platform/IPC/Connection.h:
+            (MESSAGE_CHECK_BASE):
+            - Define in terms of MESSAGE_CHECK_COMPLETION_BASE() with a
+              no-op completion handler.
+            (MESSAGE_CHECK_COMPLETION_BASE):
+            - Rename from MESSAGE_CHECK_BASE() and add completion handler
+              parameter.
+
+            * Platform/SharedMemory.h:
+            (WebKit::SharedMemory::Handle::size const): Add.
+
+            * UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
+            (MESSAGE_CHECK):
+            - Define macro to use in
+              WebPasteboardProxy::setPasteboardBufferForType().
+            - Undefine macro at end of source file due to unified sources.
+            (WebKit::WebPasteboardProxy::setPasteboardBufferForType):
+            - Add IPC::Connection& parameter after change to
+              WebPasteboardProxy.messages.in.  Use with MESSAGE_CHECK().
+            - Validate `size` parameter using MESSAGE_CHECK().  Because
+              SharedMemory::Handle::size() returns a size_t value, we do not
+              need to check `size <= std::numeric_limits<size_t>::max()`.
+            - Add static_cast<size_t>() to size parameter to denote type
+              change.
+            * UIProcess/WebPasteboardProxy.h:
+            (WebKit::WebPasteboardProxy::setPasteboardBufferForType):
+            - Add IPC::Connection& parameter after change to
+              WebPasteboardProxy.messages.in.
+            * UIProcess/WebPasteboardProxy.messages.in:
+            (SetPasteboardBufferForType):
+            - Add 'WantsConnection' attribute to add IPC::Connection&
+              parameter to WebPasteboardProxy::setPasteboardBufferForType().
+
 2020-04-07  Alan Coon  <alancoon@apple.com>
 

branches/safari-609.2.1.2-branch/Source/WebKit/Platform/IPC/Connection.h

@@ -77 +77 @@
 };
 
-#define MESSAGE_CHECK_BASE(assertion, connection) do \
+#define MESSAGE_CHECK_BASE(assertion, connection) MESSAGE_CHECK_COMPLETION_BASE(assertion, connection, (void)0)
+
+#define MESSAGE_CHECK_COMPLETION_BASE(assertion, connection, completion) do \
     if (!(assertion)) { \
         ASSERT(assertion); \
         (connection)->markCurrentlyDispatchedMessageAsInvalid(); \
+        { completion; } \
         return; \
     } \

branches/safari-609.2.1.2-branch/Source/WebKit/Platform/SharedMemory.h

@@ -73 +73 @@
 
         bool isNull() const;
+
+#if OS(DARWIN) || OS(WINDOWS)
+        size_t size() const { return m_size; }
+#endif
 
         void clear();

branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm

@@ -27 +27 @@
 #import "WebPasteboardProxy.h"
 
+#import "Connection.h"
 #import "SandboxExtension.h"
 #import "WebProcessProxy.h"
@@ -35 +36 @@
 #import <WebCore/SharedBuffer.h>
 #import <wtf/URL.h>
+
+#define MESSAGE_CHECK(assertion, completion) MESSAGE_CHECK_COMPLETION_BASE(assertion, (&connection), completion)
 
 namespace WebKit {
@@ -157 +160 @@
 }
 
-void WebPasteboardProxy::setPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle& handle, uint64_t size, CompletionHandler<void(int64_t)>&& completionHandler)
+void WebPasteboardProxy::setPasteboardBufferForType(IPC::Connection& connection, const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle& handle, uint64_t size, CompletionHandler<void(int64_t)>&& completionHandler)
 {
     if (handle.isNull())
         return completionHandler(PlatformPasteboard(pasteboardName).setBufferForType(0, pasteboardType));
+
+    // SharedMemory::Handle::size() is rounded up to the nearest page.
+    MESSAGE_CHECK(size && size <= handle.size(), completionHandler(0));
+
     RefPtr<SharedMemory> sharedMemoryBuffer = SharedMemory::map(handle, SharedMemory::Protection::ReadOnly);
-    auto buffer = SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), size);
+    auto buffer = SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), static_cast<size_t>(size));
     completionHandler(PlatformPasteboard(pasteboardName).setBufferForType(buffer.ptr(), pasteboardType));
 }
@@ -255 +262 @@
 
 } // namespace WebKit
+
+#undef MESSAGE_CHECK

branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/WebPasteboardProxy.h

@@ -94 +94 @@
     void setPasteboardColor(const String&, const WebCore::Color&, CompletionHandler<void(int64_t)>&&);
     void setPasteboardStringForType(const String& pasteboardName, const String& pasteboardType, const String&, CompletionHandler<void(int64_t)>&&);
-    void setPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle&, uint64_t size, CompletionHandler<void(int64_t)>&&);
+    void setPasteboardBufferForType(IPC::Connection&, const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle&, uint64_t size, CompletionHandler<void(int64_t)>&&);
 #endif
 

branches/safari-609.2.1.2-branch/Source/WebKit/UIProcess/WebPasteboardProxy.messages.in

@@ -57 +57 @@
     SetPasteboardColor(String pasteboardName, WebCore::Color color) -> (int64_t changeCount) Synchronous
     SetPasteboardStringForType(String pasteboardName, String pasteboardType, String string) -> (int64_t changeCount) Synchronous
-    SetPasteboardBufferForType(String pasteboardName, String pasteboardType, WebKit::SharedMemory::Handle handle, uint64_t size) -> (int64_t changeCount) Synchronous
+    SetPasteboardBufferForType(String pasteboardName, String pasteboardType, WebKit::SharedMemory::Handle handle, uint64_t size) -> (int64_t changeCount) Synchronous WantsConnection
 #endif