Changeset 269030 in webkit

Timestamp:

Oct 27, 2020, 4:24:48 AM (6 years ago)

Author:

calvaris@igalia.com

Message:

[EME][GStreamer][Thunder] Make response parsing message more robust
​https://bugs.webkit.org/show_bug.cgi?id=218172

Reviewed by Philippe Normand.

ParsedResponseMessage checks now for empty buffers and we assert
on that in the code. We also add some other checks that could
trigger crashes if failed.

No new tests needed, just a rework.

• platform/graphics/gstreamer/eme/CDMThunder.cpp:

(WebCore::ParsedResponseMessage::ParsedResponseMessage):
(WebCore::ParsedResponseMessage::isValid const):
(WebCore::ParsedResponseMessage::operator bool const):
(WebCore::ParsedResponseMessage::operator! const):
(WebCore::CDMInstanceSessionThunder::challengeGeneratedCallback):
(WebCore::CDMInstanceSessionThunder::updateLicense):
(WebCore::CDMInstanceSessionThunder::loadSession):
(WebCore::CDMInstanceSessionThunder::removeSessionData):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/graphics/gstreamer/eme/CDMThunder.cpp (modified) (7 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-10-27  Xabier Rodriguez Calvar  <calvaris@igalia.com>
+
+        [EME][GStreamer][Thunder] Make response parsing message more robust
+        https://bugs.webkit.org/show_bug.cgi?id=218172
+
+        Reviewed by Philippe Normand.
+
+        ParsedResponseMessage checks now for empty buffers and we assert
+        on that in the code. We also add some other checks that could
+        trigger crashes if failed.
+
+        No new tests needed, just a rework.
+
+        * platform/graphics/gstreamer/eme/CDMThunder.cpp:
+        (WebCore::ParsedResponseMessage::ParsedResponseMessage):
+        (WebCore::ParsedResponseMessage::isValid const):
+        (WebCore::ParsedResponseMessage::operator bool const):
+        (WebCore::ParsedResponseMessage::operator! const):
+        (WebCore::CDMInstanceSessionThunder::challengeGeneratedCallback):
+        (WebCore::CDMInstanceSessionThunder::updateLicense):
+        (WebCore::CDMInstanceSessionThunder::loadSession):
+        (WebCore::CDMInstanceSessionThunder::removeSessionData):
+
 2020-10-27  Tetsuharu Ohzeki  <tetsuharu.ohzeki@gmail.com>
 

trunk/Source/WebCore/platform/graphics/gstreamer/eme/CDMThunder.cpp

@@ -311 +311 @@
     ParsedResponseMessage(const RefPtr<SharedBuffer>& buffer)
     {
-        if (!buffer)
+        if (!buffer || !buffer->size())
             return;
 
+        GST_DEBUG("parsing buffer of size %zu", buffer->size());
+        GST_MEMDUMP("buffer", buffer->dataAsUInt8Ptr(), buffer->size());
+
         StringView payload(reinterpret_cast<const LChar*>(buffer->data()), buffer->size());
-        StringView type(reinterpret_cast<const LChar*>(":Type:"), 6);
+        static NeverDestroyed<StringView> type(reinterpret_cast<const LChar*>(":Type:"), 6);
         size_t typePosition = payload.find(type, 0);
         StringView requestType(payload.characters8(), typePosition != notFound ? typePosition : 0);
@@ -326 +329 @@
 
         m_payload = SharedBuffer::create(payload.characters8() + offset, payload.length() - offset);
-    }
-
+
+        m_isValid = true;
+    }
+
+    bool isValid() const { return m_isValid; }
     bool hasPayload() const { return static_cast<bool>(m_payload); }
     const Ref<SharedBuffer>& payload() const& { ASSERT(m_payload); return m_payload.value(); }
@@ -334 +340 @@
     WebCore::MediaKeyMessageType type() const { ASSERT(m_type); return m_type.value(); }
     WebCore::MediaKeyMessageType typeOr(WebCore::MediaKeyMessageType alternate) const { return m_type ? m_type.value() : alternate; }
+    explicit operator bool() const { return m_isValid; }
+    bool operator!() const { return !m_isValid; }
 
 private:
+    bool m_isValid { false };
     Optional<Ref<SharedBuffer>> m_payload;
     Optional<WebCore::MediaKeyMessageType> m_type;
@@ -343 +352 @@
 {
     ParsedResponseMessage parsedResponseMessage(buffer);
+    ASSERT(parsedResponseMessage);
 
     if (!m_challengeCallbacks.isEmpty()) {
         m_message = WTFMove(parsedResponseMessage.payload());
-        m_needsIndividualization = parsedResponseMessage.type() == CDMInstanceSession::MessageType::IndividualizationRequest;
+        m_needsIndividualization = parsedResponseMessage.hasType()
+            && parsedResponseMessage.type() == CDMInstanceSession::MessageType::IndividualizationRequest;
 
         for (const auto& challengeCallback : m_challengeCallbacks)
@@ -529 +540 @@
                 // will even be other parts of the spec where not having structured data will be bad.
                 ParsedResponseMessage parsedResponseMessage(responseMessage);
+                ASSERT(parsedResponseMessage);
                 if (parsedResponseMessage.hasPayload()) {
                     Ref<SharedBuffer> message = WTFMove(parsedResponseMessage.payload());
@@ -563 +575 @@
                 // will even be other parts of the spec where not having structured data will be bad.
                 ParsedResponseMessage parsedResponseMessage(responseMessage);
+                ASSERT(parsedResponseMessage);
                 if (parsedResponseMessage.hasPayload()) {
                     Ref<SharedBuffer> message = WTFMove(parsedResponseMessage.payload());
@@ -609 +622 @@
             else {
                 ParsedResponseMessage parsedResponseMessage(buffer);
+                ASSERT(parsedResponseMessage);
                 if (parsedResponseMessage.hasPayload()) {
                     Ref<SharedBuffer> message = WTFMove(parsedResponseMessage.payload());