Changeset 286327 in webkit

Timestamp:

Nov 30, 2021, 2:23:54 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

nullptr deref in InbandChapterTrackPrivateAVFObjC::processChapters
​https://bugs.webkit.org/show_bug.cgi?id=233605

Patch by Gabriel Nava Marino <​gnavamarino@apple.com> on 2021-11-30
Reviewed by Eric Carlson.

Source/WebCore:

The createChapterCue lambda gets dispatched onto the main thread. When it executes,
the client might no longer be valid, so we are adding a nullptr check at the start
of the lambda, as is done at the start of the method.

Test: media/track/track-in-band-chapters-invalid-client-crash.html

• platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm:

(WebCore::InbandChapterTrackPrivateAVFObjC::processChapters):

LayoutTests:

• media/track/track-in-band-chapters-invalid-client-crash-expected.txt: Added.
• media/track/track-in-band-chapters-invalid-client-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/media/track/track-in-band-chapters-invalid-client-crash-expected.txt (added)
• LayoutTests/media/track/track-in-band-chapters-invalid-client-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-30  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        nullptr deref in InbandChapterTrackPrivateAVFObjC::processChapters
+        https://bugs.webkit.org/show_bug.cgi?id=233605
+
+        Reviewed by Eric Carlson.
+
+        * media/track/track-in-band-chapters-invalid-client-crash-expected.txt: Added.
+        * media/track/track-in-band-chapters-invalid-client-crash.html: Added.
+
 2021-11-30  Robert Jenner  <Jenner@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-30  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        nullptr deref in InbandChapterTrackPrivateAVFObjC::processChapters
+        https://bugs.webkit.org/show_bug.cgi?id=233605
+
+        Reviewed by Eric Carlson.
+
+        The createChapterCue lambda gets dispatched onto the main thread. When it executes,
+        the client might no longer be valid, so we are adding a nullptr check at the start
+        of the lambda, as is done at the start of the method.
+
+        Test: media/track/track-in-band-chapters-invalid-client-crash.html
+
+        * platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm:
+        (WebCore::InbandChapterTrackPrivateAVFObjC::processChapters):
+
 2021-11-30  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/platform/graphics/avfoundation/objc/InbandChapterTrackPrivateAVFObjC.mm

@@ -55 +55 @@
     auto identifier = LOGIDENTIFIER;
     auto createChapterCue = ([this, identifier] (AVMetadataItem *item, int chapterNumber) mutable {
+        if (!client())
+            return;
         ChapterData chapterData = { PAL::toMediaTime([item time]), PAL::toMediaTime([item duration]), [item stringValue] };
         if (m_processedChapters.contains(chapterData))