Changeset 273692 in webkit

Timestamp:

Mar 1, 2021, 2:29:17 PM (5 years ago)

Author:

Chris Dumez

Message:

Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
​https://bugs.webkit.org/show_bug.cgi?id=222567
<rdar://74860464>

Reviewed by Eric Carlson.

AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
then does some checks that potentially run JS and thus call registerProcessor() again (potentially
with the same name). To address this, we now check the map again after potentially running the
JS code.

• Modules/webaudio/AudioWorkletGlobalScope.cpp:

(WebCore::AudioWorkletGlobalScope::registerProcessor):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/webaudio/AudioWorkletGlobalScope.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-01  Chris Dumez  <cdumez@apple.com>
+
+        Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
+        https://bugs.webkit.org/show_bug.cgi?id=222567
+        <rdar://74860464>
+
+        Reviewed by Eric Carlson.
+
+        AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
+        then does some checks that potentially run JS and thus call registerProcessor() again (potentially
+        with the same name). To address this, we now check the map again after potentially running the
+        JS code.
+
+        * Modules/webaudio/AudioWorkletGlobalScope.cpp:
+        (WebCore::AudioWorkletGlobalScope::registerProcessor):
+
 2021-03-01  Martin Robinson  <mrobinson@webkit.org>
 

trunk/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp

@@ -83 +83 @@
 
     if (!jsConstructor->isConstructor(vm))
-        return Exception { TypeError, "Class definitition passed to registerProcessor() is not a constructor"_s };
+        return Exception { TypeError, "Class definition passed to registerProcessor() is not a constructor"_s };
 
     auto prototype = jsConstructor->getPrototype(vm, globalObject);
@@ -89 +89 @@
 
     if (!prototype.isObject())
-        return Exception { TypeError, "Class definitition passed to registerProcessor() has invalid prototype"_s };
+        return Exception { TypeError, "Class definition passed to registerProcessor() has invalid prototype"_s };
 
     auto parameterDescriptorsValue = jsConstructor->get(globalObject, JSC::Identifier::fromString(vm, "parameterDescriptors"));
@@ -111 +111 @@
     }
 
-    m_processorConstructorMap.add(name, WTFMove(processorContructor));
+    auto addResult = m_processorConstructorMap.add(name, WTFMove(processorContructor));
+
+    // We've already checked at the beginning of this function but then we ran some JS so we need to check again.
+    if (!addResult.isNewEntry)
+        return Exception { NotSupportedError, "A processor was already registered with this name"_s };
 
     thread().messagingProxy().postTaskToAudioWorklet([name = name.isolatedCopy(), parameterDescriptors = crossThreadCopy(parameterDescriptors)](AudioWorklet& worklet) mutable {