Changeset 258334 in webkit


Ignore:
Timestamp:
Mar 12, 2020 9:28:22 AM (4 years ago)
Author:
ddkilzer@apple.com
Message:

WebPasteboardProxy::SetPasteboardBufferForType should validate its size parameter
<​https://webkit.org/b/208902>
<rdar://problem/60181117>

Reviewed by Chris Dumez.

  • Platform/IPC/Connection.h:

(MESSAGE_CHECK_BASE):

  • Define in terms of MESSAGE_CHECK_COMPLETION_BASE() with a no-op completion handler.

(MESSAGE_CHECK_COMPLETION_BASE):

  • Rename from MESSAGE_CHECK_BASE() and add completion handler parameter.
  • Platform/SharedMemory.h:

(WebKit::SharedMemory::Handle::size const): Add.

  • UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:

(MESSAGE_CHECK):

  • Define macro to use in WebPasteboardProxy::setPasteboardBufferForType().
  • Undefine macro at end of source file due to unified sources.

(WebKit::WebPasteboardProxy::setPasteboardBufferForType):

  • Add IPC::Connection& parameter after change to WebPasteboardProxy.messages.in. Use with MESSAGE_CHECK().
  • Validate size parameter using MESSAGE_CHECK(). Because SharedMemory::Handle::size() returns a size_t value, we do not need to check size <= std::numeric_limits<size_t>::max().
  • Add static_cast<size_t>() to size parameter to denote type change.
  • UIProcess/WebPasteboardProxy.h:

(WebKit::WebPasteboardProxy::setPasteboardBufferForType):

  • Add IPC::Connection& parameter after change to WebPasteboardProxy.messages.in.
  • UIProcess/WebPasteboardProxy.messages.in:

(SetPasteboardBufferForType):

  • Add 'WantsConnection' attribute to add IPC::Connection& parameter to WebPasteboardProxy::setPasteboardBufferForType().
Location:
trunk/Source/WebKit
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r258329 r258334  
     12020-03-12  David Kilzer  <ddkilzer@apple.com>
     2
     3        WebPasteboardProxy::SetPasteboardBufferForType should validate its `size` parameter
     4        <https://webkit.org/b/208902>
     5        <rdar://problem/60181117>
     6
     7        Reviewed by Chris Dumez.
     8
     9        * Platform/IPC/Connection.h:
     10        (MESSAGE_CHECK_BASE):
     11        - Define in terms of MESSAGE_CHECK_COMPLETION_BASE() with a
     12          no-op completion handler.
     13        (MESSAGE_CHECK_COMPLETION_BASE):
     14        - Rename from MESSAGE_CHECK_BASE() and add completion handler
     15          parameter.
     16
     17        * Platform/SharedMemory.h:
     18        (WebKit::SharedMemory::Handle::size const): Add.
     19
     20        * UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
     21        (MESSAGE_CHECK):
     22        - Define macro to use in
     23          WebPasteboardProxy::setPasteboardBufferForType().
     24        - Undefine macro at end of source file due to unified sources.
     25        (WebKit::WebPasteboardProxy::setPasteboardBufferForType):
     26        - Add IPC::Connection& parameter after change to
     27          WebPasteboardProxy.messages.in.  Use with MESSAGE_CHECK().
     28        - Validate `size` parameter using MESSAGE_CHECK().  Because
     29          SharedMemory::Handle::size() returns a size_t value, we do not
     30          need to check `size <= std::numeric_limits<size_t>::max()`.
     31        - Add static_cast<size_t>() to size parameter to denote type
     32          change.
     33        * UIProcess/WebPasteboardProxy.h:
     34        (WebKit::WebPasteboardProxy::setPasteboardBufferForType):
     35        - Add IPC::Connection& parameter after change to
     36          WebPasteboardProxy.messages.in.
     37        * UIProcess/WebPasteboardProxy.messages.in:
     38        (SetPasteboardBufferForType):
     39        - Add 'WantsConnection' attribute to add IPC::Connection&
     40          parameter to WebPasteboardProxy::setPasteboardBufferForType().
     41
    1422020-03-12  Youenn Fablet  <youenn@apple.com>
    243

  • trunk/Source/WebKit/Platform/IPC/Connection.h

    r258201 r258334  
    7777};
    7878
    79 #define MESSAGE_CHECK_BASE(assertion, connection) do \
     79#define MESSAGE_CHECK_BASE(assertion, connection) MESSAGE_CHECK_COMPLETION_BASE(assertion, connection, (void)0)
     80
     81#define MESSAGE_CHECK_COMPLETION_BASE(assertion, connection, completion) do \
    8082    if (!(assertion)) { \
    8183        ASSERT(assertion); \
    8284        (connection)->markCurrentlyDispatchedMessageAsInvalid(); \
     85        { completion; } \
    8386        return; \
    8487    } \

  • trunk/Source/WebKit/Platform/SharedMemory.h

    r251765 r258334  
    7373
    7474        bool isNull() const;
     75
     76#if OS(DARWIN) || OS(WINDOWS)
     77        size_t size() const { return m_size; }
     78#endif
    7579
    7680        void clear();

  • trunk/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm

    r258240 r258334  
    2727#import "WebPasteboardProxy.h"
    2828
     29#import "Connection.h"
    2930#import "SandboxExtension.h"
    3031#import "WebProcessProxy.h"
    … …  
    3536#import <WebCore/SharedBuffer.h>
    3637#import <wtf/URL.h>
     38
     39#define MESSAGE_CHECK(assertion, completion) MESSAGE_CHECK_COMPLETION_BASE(assertion, (&connection), completion)
    3740
    3841namespace WebKit {
    … …  
    172175}
    173176
    174 void WebPasteboardProxy::setPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle& handle, uint64_t size, CompletionHandler<void(int64_t)>&& completionHandler)
     177void WebPasteboardProxy::setPasteboardBufferForType(IPC::Connection& connection, const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle& handle, uint64_t size, CompletionHandler<void(int64_t)>&& completionHandler)
    175178{
    176179    ASSERT(!pasteboardType.isNull());
    … …  
    180183    if (handle.isNull())
    181184        return completionHandler(PlatformPasteboard(pasteboardName).setBufferForType(nullptr, pasteboardType));
     185
     186    // SharedMemory::Handle::size() is rounded up to the nearest page.
     187    MESSAGE_CHECK(size && size <= handle.size(), completionHandler(0));
     188
    182189    RefPtr<SharedMemory> sharedMemoryBuffer = SharedMemory::map(handle, SharedMemory::Protection::ReadOnly);
    183190    if (!sharedMemoryBuffer)
    184191        return completionHandler(0);
    185     auto buffer = SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), size);
     192    auto buffer = SharedBuffer::create(static_cast<unsigned char *>(sharedMemoryBuffer->data()), static_cast<size_t>(size));
    186193    completionHandler(PlatformPasteboard(pasteboardName).setBufferForType(buffer.ptr(), pasteboardType));
    187194}
    … …  
    288295
    289296} // namespace WebKit
     297
     298#undef MESSAGE_CHECK

  • trunk/Source/WebKit/UIProcess/WebPasteboardProxy.h

    r257145 r258334  
    9393    void setPasteboardColor(const String&, const WebCore::Color&, CompletionHandler<void(int64_t)>&&);
    9494    void setPasteboardStringForType(const String& pasteboardName, const String& pasteboardType, const String&, CompletionHandler<void(int64_t)>&&);
    95     void setPasteboardBufferForType(const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle&, uint64_t size, CompletionHandler<void(int64_t)>&&);
     95    void setPasteboardBufferForType(IPC::Connection&, const String& pasteboardName, const String& pasteboardType, const SharedMemory::Handle&, uint64_t size, CompletionHandler<void(int64_t)>&&);
    9696#endif
    9797

  • trunk/Source/WebKit/UIProcess/WebPasteboardProxy.messages.in

    r257145 r258334  
    5656    SetPasteboardColor(String pasteboardName, WebCore::Color color) -> (int64_t changeCount) Synchronous
    5757    SetPasteboardStringForType(String pasteboardName, String pasteboardType, String string) -> (int64_t changeCount) Synchronous
    58     SetPasteboardBufferForType(String pasteboardName, String pasteboardType, WebKit::SharedMemory::Handle handle, uint64_t size) -> (int64_t changeCount) Synchronous
     58    SetPasteboardBufferForType(String pasteboardName, String pasteboardType, WebKit::SharedMemory::Handle handle, uint64_t size) -> (int64_t changeCount) Synchronous WantsConnection
    5959#endif
    6060
Note: See TracChangeset for help on using the changeset viewer.