Changeset 287313 in webkit

Timestamp:

Dec 21, 2021, 6:07:08 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

IPC streams should not accept 0-length stream buffers
​https://bugs.webkit.org/show_bug.cgi?id=234552
<rdar://79725420>

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-12-21
Reviewed by Antti Koivisto.

Make decoding 0-length stream buffers fail. These buffers are not useful.

No new tests, tests need additional implementation, will be added
in subsequent commits.

• Platform/IPC/StreamConnectionBuffer.cpp:

(IPC::StreamConnectionBuffer::StreamConnectionBuffer):
(IPC::StreamConnectionBuffer::decode):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/StreamConnectionBuffer.cpp (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-12-21  Kimmo Kinnunen  <kkinnunen@apple.com>
+
+        IPC streams should not accept 0-length stream buffers
+        https://bugs.webkit.org/show_bug.cgi?id=234552
+        <rdar://79725420>
+
+        Reviewed by Antti Koivisto.
+
+        Make decoding 0-length stream buffers fail. These buffers are not useful.
+
+        No new tests, tests need additional implementation, will be added
+        in subsequent commits.
+
+        * Platform/IPC/StreamConnectionBuffer.cpp:
+        (IPC::StreamConnectionBuffer::StreamConnectionBuffer):
+        (IPC::StreamConnectionBuffer::decode):
+
 2021-12-20  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebKit/Platform/IPC/StreamConnectionBuffer.cpp

@@ -43 +43 @@
     , m_sharedMemory(createMemory(memorySize))
 {
+    ASSERT(m_dataSize > 0);
     ASSERT(m_dataSize <= maximumSize());
 }
@@ -51 +52 @@
     , m_clientWaitSemaphore(WTFMove(clientWaitSemaphore))
 {
+    ASSERT(m_dataSize > 0);
     ASSERT(m_dataSize <= maximumSize());
 }
@@ -89 +91 @@
         return std::nullopt;
     size_t dataSize = static_cast<size_t>(ipcHandle->dataSize);
-    if (dataSize < headerSize())
+    if (dataSize <= headerSize())
         return std::nullopt;
     if (dataSize > headerSize() + maximumSize())