Changeset 259774 in webkit

Timestamp:

Apr 8, 2020, 6:10:13 PM (6 years ago)

Author:

ddkilzer@apple.com

Message:

WebKit::ShareableBitmap::Handle::decode() should validate m_size instance variables
<​https://webkit.org/b/210211>
<rdar://problem/60543986>

Reviewed by Alex Christensen.

• Shared/ShareableBitmap.cpp:

(WebKit::ShareableBitmap::Handle::decode): Return early if
either m_size instance variable is less than zero.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/ShareableBitmap.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        WebKit::ShareableBitmap::Handle::decode() should validate m_size instance variables
+        <https://webkit.org/b/210211>
+        <rdar://problem/60543986>
+
+        Reviewed by Alex Christensen.
+
+        * Shared/ShareableBitmap.cpp:
+        (WebKit::ShareableBitmap::Handle::decode): Return early if
+        either m_size instance variable is less than zero.
+
 2020-04-08  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/Shared/ShareableBitmap.cpp

@@ -55 +55 @@
     if (!decoder.decode(handle.m_size))
         return false;
+    if (handle.m_size.width() < 0 || handle.m_size.height() < 0)
+        return false;
     if (!decoder.decode(handle.m_configuration))
         return false;