Changeset 280828 in webkit

Timestamp:

Aug 10, 2021, 1:57:20 AM (5 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r273692 - Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
​https://bugs.webkit.org/show_bug.cgi?id=222567
<rdar://74860464>

Reviewed by Eric Carlson.

AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
then does some checks that potentially run JS and thus call registerProcessor() again (potentially
with the same name). To address this, we now check the map again after potentially running the
JS code.

• Modules/webaudio/AudioWorkletGlobalScope.cpp:

(WebCore::AudioWorkletGlobalScope::registerProcessor):

Location:

releases/WebKitGTK/webkit-2.32/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/webaudio/AudioWorkletGlobalScope.cpp (modified) (3 diffs)

releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-01  Chris Dumez  <cdumez@apple.com>
+
+        Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
+        https://bugs.webkit.org/show_bug.cgi?id=222567
+        <rdar://74860464>
+
+        Reviewed by Eric Carlson.
+
+        AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
+        then does some checks that potentially run JS and thus call registerProcessor() again (potentially
+        with the same name). To address this, we now check the map again after potentially running the
+        JS code.
+
+        * Modules/webaudio/AudioWorkletGlobalScope.cpp:
+        (WebCore::AudioWorkletGlobalScope::registerProcessor):
+
 2021-03-03  Julian Gonzalez  <julian_a_gonzalez@apple.com>
 

releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp

@@ -83 +83 @@
 
     if (!jsConstructor->isConstructor(vm))
-        return Exception { TypeError, "Class definitition passed to registerProcessor() is not a constructor"_s };
+        return Exception { TypeError, "Class definition passed to registerProcessor() is not a constructor"_s };
 
     auto prototype = jsConstructor->getPrototype(vm, globalObject);
@@ -89 +89 @@
 
     if (!prototype.isObject())
-        return Exception { TypeError, "Class definitition passed to registerProcessor() has invalid prototype"_s };
+        return Exception { TypeError, "Class definition passed to registerProcessor() has invalid prototype"_s };
 
     auto parameterDescriptorsValue = jsConstructor->get(globalObject, JSC::Identifier::fromString(vm, "parameterDescriptors"));
@@ -111 +111 @@
     }
 
-    m_processorConstructorMap.add(name, WTFMove(processorContructor));
+    auto addResult = m_processorConstructorMap.add(name, WTFMove(processorContructor));
+
+    // We've already checked at the beginning of this function but then we ran some JS so we need to check again.
+    if (!addResult.isNewEntry)
+        return Exception { NotSupportedError, "A processor was already registered with this name"_s };
 
     thread().messagingProxy().postTaskToAudioWorklet([name = name.isolatedCopy(), parameterDescriptors = crossThreadCopy(parameterDescriptors)](AudioWorklet& worklet) mutable {