Changeset 287632 in webkit

Timestamp:

Jan 5, 2022, 10:21:20 AM (5 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r287313. rdar://problem/87124922

IPC streams should not accept 0-length stream buffers
​https://bugs.webkit.org/show_bug.cgi?id=234552
<rdar://79725420>

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-12-21
Reviewed by Antti Koivisto.

Make decoding 0-length stream buffers fail. These buffers are not useful.

No new tests, tests need additional implementation, will be added
in subsequent commits.

• Platform/IPC/StreamConnectionBuffer.cpp: (IPC::StreamConnectionBuffer::StreamConnectionBuffer): (IPC::StreamConnectionBuffer::decode):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@287313 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/StreamConnectionBuffer.cpp (modified) (3 diffs)

branches/safari-612-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2022-01-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r287313. rdar://problem/87124922
+
+    IPC streams should not accept 0-length stream buffers
+    https://bugs.webkit.org/show_bug.cgi?id=234552
+    <rdar://79725420>
+    
+    Patch by Kimmo Kinnunen <kkinnunen@apple.com> on 2021-12-21
+    Reviewed by Antti Koivisto.
+    
+    Make decoding 0-length stream buffers fail. These buffers are not useful.
+    
+    No new tests, tests need additional implementation, will be added
+    in subsequent commits.
+    
+    * Platform/IPC/StreamConnectionBuffer.cpp:
+    (IPC::StreamConnectionBuffer::StreamConnectionBuffer):
+    (IPC::StreamConnectionBuffer::decode):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287313 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-12-21  Kimmo Kinnunen  <kkinnunen@apple.com>
+
+            IPC streams should not accept 0-length stream buffers
+            https://bugs.webkit.org/show_bug.cgi?id=234552
+            <rdar://79725420>
+
+            Reviewed by Antti Koivisto.
+
+            Make decoding 0-length stream buffers fail. These buffers are not useful.
+
+            No new tests, tests need additional implementation, will be added
+            in subsequent commits.
+
+            * Platform/IPC/StreamConnectionBuffer.cpp:
+            (IPC::StreamConnectionBuffer::StreamConnectionBuffer):
+            (IPC::StreamConnectionBuffer::decode):
+
 2022-01-05  Russell Epstein  <repstein@apple.com>
 

branches/safari-612-branch/Source/WebKit/Platform/IPC/StreamConnectionBuffer.cpp

@@ -43 +43 @@
     , m_sharedMemory(createMemory(memorySize))
 {
+    ASSERT(m_dataSize > 0);
     ASSERT(m_dataSize <= maximumSize());
 }
@@ -51 +52 @@
     , m_clientWaitSemaphore(WTFMove(clientWaitSemaphore))
 {
+    ASSERT(m_dataSize > 0);
     ASSERT(m_dataSize <= maximumSize());
 }
@@ -89 +91 @@
         return std::nullopt;
     size_t dataSize = static_cast<size_t>(ipcHandle->dataSize);
-    if (dataSize < headerSize())
+    if (dataSize <= headerSize())
         return std::nullopt;
     if (dataSize > headerSize() + maximumSize())