Changeset 284434 in webkit

Timestamp:

Oct 18, 2021 8:51:56 PM (9 months ago)

Author:

Jean-Yves Avenard

Message:

WebM with invalid size should fail to load with error
​https://bugs.webkit.org/show_bug.cgi?id=231886
rdar://77969801

Reviewed by Jer Noble.

Source/WebCore:

libwebm for some elements are using a std::string or a std::vector<uint8_t>
to store their content. Those have infallible memory allocators.
We limit the size we allow the parser to use to some reasonable values.

Test: media/media-webm-invalid-check.html

• platform/graphics/cocoa/SourceBufferParserWebM.cpp:

(WebCore::SourceBufferParserWebM::OnElementBegin):

LayoutTests:

• media/content/invalid-size.webm: Added.
• media/media-webm-invalid-check-expected.txt: Added.
• media/media-webm-invalid-check.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/media/content/invalid-size.webm (added)
• LayoutTests/media/media-webm-invalid-check-expected.txt (added)
• LayoutTests/media/media-webm-invalid-check.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/cocoa/SourceBufferParserWebM.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-10-18  Jean-Yves Avenard  <jya@apple.com>
+
+        WebM with invalid size should fail to load with error
+        https://bugs.webkit.org/show_bug.cgi?id=231886
+        rdar://77969801
+
+        Reviewed by Jer Noble.
+
+        * media/content/invalid-size.webm: Added.
+        * media/media-webm-invalid-check-expected.txt: Added.
+        * media/media-webm-invalid-check.html: Added.
+
 2021-10-18  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-10-18  Jean-Yves Avenard  <jya@apple.com>
+
+        WebM with invalid size should fail to load with error
+        https://bugs.webkit.org/show_bug.cgi?id=231886
+        rdar://77969801
+
+        Reviewed by Jer Noble.
+
+        libwebm for some elements are using a std::string or a std::vector<uint8_t>
+        to store their content. Those have infallible memory allocators.
+        We limit the size we allow the parser to use to some reasonable values.
+
+        Test: media/media-webm-invalid-check.html
+
+        * platform/graphics/cocoa/SourceBufferParserWebM.cpp:
+        (WebCore::SourceBufferParserWebM::OnElementBegin):
+
 2021-10-18  Alan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/platform/graphics/cocoa/SourceBufferParserWebM.cpp

@@ -835 +835 @@
     INFO_LOG_IF_POSSIBLE(LOGIDENTIFIER, "state(", oldState, "->", m_state, "), id(", metadata.id, "), position(", metadata.position, "), headerSize(", metadata.header_size, "), size(", metadata.size, ")");
 
+    // Apply some sanity check; libwebm::StringParser will read the content into a std::string and ByteParser into a std::vector
+    std::optional<size_t> maxElementSizeAllowed;
+    switch (metadata.id) {
+    case Id::kChapterStringUid:
+    case Id::kChapString:
+    case Id::kChapLanguage:
+    case Id::kChapCountry:
+    case Id::kDocType:
+    case Id::kTitle:
+    case Id::kMuxingApp:
+    case Id::kWritingApp:
+    case Id::kTagName:
+    case Id::kTagLanguage:
+    case Id::kTagString:
+    case Id::kTargetType:
+    case Id::kName:
+    case Id::kLanguage:
+    case Id::kCodecId:
+    case Id::kCodecName:
+        maxElementSizeAllowed = 1 * 1024 * 1024; // 1MiB
+        break;
+    case Id::kBlockAdditional:
+    case Id::kContentEncKeyId:
+    case Id::kProjectionPrivate:
+    case Id::kTagBinary:
+        maxElementSizeAllowed = 16 * 1024 * 1024; // 16MiB
+        break;
+    default:
+        break;
+    }
+    if (maxElementSizeAllowed && metadata.size >= *maxElementSizeAllowed)
+        return Status(Status::kNotEnoughMemory);
+
     return Status(Status::kOkCompleted);
 }