Changeset 260216 in webkit

Timestamp:

Apr 16, 2020, 1:13:01 PM (5 years ago)

Author:

ddkilzer@apple.com

Message:

Rollout: [IPC Hardening] MachMessage::create() should use checked arithmetic
<​https://webkit.org/b/210572>
<rdar://problem/61729947>

Unreviewed rollout of r260160.

Appears to have caused 8 API test failures on iOS.

• Platform/IPC/cocoa/ConnectionCocoa.mm:

(IPC::Connection::sendOutgoingMessage):

• Platform/IPC/cocoa/MachMessage.cpp:

(IPC::MachMessage::create):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/cocoa/ConnectionCocoa.mm (modified) (1 diff)
• Platform/IPC/cocoa/MachMessage.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-16  David Kilzer  <ddkilzer@apple.com>
+
+        Rollout: [IPC Hardening] MachMessage::create() should use checked arithmetic
+        <https://webkit.org/b/210572>
+        <rdar://problem/61729947>
+
+        Unreviewed rollout of r260160.
+
+        Appears to have caused 8 API test failures on iOS.
+
+        * Platform/IPC/cocoa/ConnectionCocoa.mm:
+        (IPC::Connection::sendOutgoingMessage):
+        * Platform/IPC/cocoa/MachMessage.cpp:
+        (IPC::MachMessage::create):
+
 2020-04-16  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebKit/Platform/IPC/cocoa/ConnectionCocoa.mm

@@ -310 +310 @@
     size_t safeMessageSize = messageSize.unsafeGet();
     auto message = MachMessage::create(encoder->messageReceiverName().toString(), encoder->messageName().toString(), safeMessageSize);
-    if (!message)
-        return false;
 
     auto* header = message->header();

trunk/Source/WebKit/Platform/IPC/cocoa/MachMessage.cpp

@@ -42 +42 @@
 std::unique_ptr<MachMessage> MachMessage::create(CString&& messageReceiverName, CString&& messageName, size_t size)
 {
-    auto bufferSize = CheckedSize(sizeof(MachMessage)) + size;
-    if (bufferSize.hasOverflowed())
-        return nullptr;
-    void* memory = WTF::fastZeroedMalloc(bufferSize.unsafeGet());
+    void* memory = WTF::fastZeroedMalloc(sizeof(MachMessage) + size);
     return std::unique_ptr<MachMessage> { new (NotNull, memory) MachMessage { WTFMove(messageReceiverName), WTFMove(messageName), size } };
 }