Changeset 90839 in webkit

Timestamp:

Jul 12, 2011 12:16:53 PM (13 years ago)

Author:

crogers@google.com

Message:

2011-07-12 Chris Rogers <​crogers@google.com>

webkitAudioContext does not do proper sanity checking on its arguments.
​https://bugs.webkit.org/show_bug.cgi?id=64076

Reviewed by Kenneth Russell.

No new tests since audio API is not yet implemented.

• bindings/js/JSAudioContextCustom.cpp: (WebCore::JSAudioContextConstructor::constructJSAudioContext): (WebCore::JSAudioContext::createBuffer):
• bindings/v8/custom/V8AudioContextCustom.cpp: (WebCore::V8AudioContext::constructorCallback): (WebCore::V8AudioContext::createBufferCallback):
• platform/audio/HRTFDatabaseLoader.h: (WebCore::HRTFDatabaseLoader::databaseSampleRate):
• webaudio/AudioContext.cpp: (WebCore::AudioContext::create): (WebCore::AudioContext::createOfflineContext): (WebCore::AudioContext::createBuffer):
• webaudio/AudioContext.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSAudioContextCustom.cpp (modified) (2 diffs)
• bindings/v8/custom/V8AudioContextCustom.cpp (modified) (3 diffs)
• platform/audio/HRTFDatabaseLoader.h (modified) (2 diffs)
• webaudio/AudioContext.cpp (modified) (2 diffs)
• webaudio/AudioContext.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-12  Chris Rogers  <crogers@google.com>
+
+        webkitAudioContext does not do proper sanity checking on its arguments.
+        https://bugs.webkit.org/show_bug.cgi?id=64076
+
+        Reviewed by Kenneth Russell.
+
+        No new tests since audio API is not yet implemented.
+
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContextConstructor::constructJSAudioContext):
+        (WebCore::JSAudioContext::createBuffer):
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        (WebCore::V8AudioContext::constructorCallback):
+        (WebCore::V8AudioContext::createBufferCallback):
+        * platform/audio/HRTFDatabaseLoader.h:
+        (WebCore::HRTFDatabaseLoader::databaseSampleRate):
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::create):
+        (WebCore::AudioContext::createOfflineContext):
+        (WebCore::AudioContext::createBuffer):
+        * webaudio/AudioContext.h:
+
 2011-07-12  Pratik Solanki  <psolanki@apple.com>
 

trunk/Source/WebCore/bindings/js/JSAudioContextCustom.cpp

@@ -75 +75 @@
             return throwVMError(exec, createSyntaxError(exec, "Not enough arguments"));
 
-        unsigned numberOfChannels = exec->argument(0).toInt32(exec);
-        unsigned numberOfFrames = exec->argument(1).toInt32(exec);
+        int32_t numberOfChannels = exec->argument(0).toInt32(exec);
+        int32_t numberOfFrames = exec->argument(1).toInt32(exec);
         float sampleRate = exec->argument(2).toFloat(exec);
+        
+        if (numberOfChannels <= 0 || numberOfChannels > 10)
+            return throwVMError(exec, createSyntaxError(exec, "Invalid number of channels"));
 
-        audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate);
+        if (numberOfFrames <= 0)
+            return throwVMError(exec, createSyntaxError(exec, "Invalid number of frames"));
+
+        if (sampleRate <= 0)
+            return throwVMError(exec, createSyntaxError(exec, "Invalid sample rate"));
+
+        ExceptionCode ec = 0;
+        audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate, ec);
+        if (ec) {
+            setDOMException(exec, ec);
+            return jsUndefined();
+        }
     }
 
@@ -118 +132 @@
         return throwError(exec, createSyntaxError(exec, "Not enough arguments"));
     
-    unsigned numberOfChannels = exec->argument(0).toInt32(exec);
-    unsigned numberOfFrames = exec->argument(1).toInt32(exec);
+    int32_t numberOfChannels = exec->argument(0).toInt32(exec);
+    int32_t numberOfFrames = exec->argument(1).toInt32(exec);
     float sampleRate = exec->argument(2).toFloat(exec);
+
+    if (numberOfChannels <= 0 || numberOfChannels > 10)
+        return throwVMError(exec, createSyntaxError(exec, "Invalid number of channels"));
+
+    if (numberOfFrames <= 0)
+        return throwVMError(exec, createSyntaxError(exec, "Invalid number of frames"));
+
+    if (sampleRate <= 0)
+        return throwVMError(exec, createSyntaxError(exec, "Invalid sample rate"));
 
     RefPtr<AudioBuffer> audioBuffer = audioContext->createBuffer(numberOfChannels, numberOfFrames, sampleRate);

trunk/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp

@@ -44 +44 @@
     INC_STATS("DOM.AudioContext.Contructor");
 
+    if (!args.IsConstructCall())
+        return throwError("AudioContext constructor cannot be called as a function.");
+
     Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
     if (!frame)
@@ -65 +68 @@
         bool ok = false;
 
-        unsigned numberOfChannels = toInt32(args[0], ok);
-        if (!ok)
+        int32_t numberOfChannels = toInt32(args[0], ok);
+        if (!ok || numberOfChannels <= 0 || numberOfChannels > 10)
             return throwError("Invalid number of channels", V8Proxy::SyntaxError);
 
-        unsigned numberOfFrames = toInt32(args[1], ok);
-        if (!ok)
+        int32_t numberOfFrames = toInt32(args[1], ok);
+        if (!ok || numberOfFrames <= 0)
             return throwError("Invalid number of frames", V8Proxy::SyntaxError);
 
         float sampleRate = toFloat(args[2]);
+        if (sampleRate <= 0)
+            return throwError("Invalid sample rate", V8Proxy::SyntaxError);
 
-        audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate);
+        ExceptionCode ec = 0;
+        audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate, ec);
+        if (ec)
+            return throwError(ec);
     }
 
@@ -123 +131 @@
     bool ok = false;
     
-    unsigned numberOfChannels = toInt32(args[0], ok);
-    if (!ok)
+    int32_t numberOfChannels = toInt32(args[0], ok);
+    if (!ok || numberOfChannels <= 0 || numberOfChannels > 10)
         return throwError("Invalid number of channels", V8Proxy::SyntaxError);
     
-    unsigned numberOfFrames = toInt32(args[1], ok);
-    if (!ok)
+    int32_t numberOfFrames = toInt32(args[1], ok);
+    if (!ok || numberOfFrames <= 0)
         return throwError("Invalid number of frames", V8Proxy::SyntaxError);
     

trunk/Source/WebCore/platform/audio/HRTFDatabaseLoader.h

@@ -61 +61 @@
     
     HRTFDatabase* database() { return m_hrtfDatabase.get(); }
+
+    double databaseSampleRate() const { return m_databaseSampleRate; }
     
     // Called in asynchronous loading thread.
@@ -78 +80 @@
     void loadAsynchronously();
 
-    double databaseSampleRate() const { return m_databaseSampleRate; }
-
     static HRTFDatabaseLoader* s_loader; // singleton
     OwnPtr<HRTFDatabase> m_hrtfDatabase;

trunk/Source/WebCore/webaudio/AudioContext.cpp

@@ -73 +73 @@
 
 namespace WebCore {
+    
+namespace {
+    
+bool isSampleRateRangeGood(double sampleRate)
+{
+    return sampleRate >= 22050 && sampleRate <= 96000;
+}
+
+}
 
 PassRefPtr<AudioContext> AudioContext::create(Document* document)
 {
+    ASSERT(document);
     return adoptRef(new AudioContext(document));
 }
 
-PassRefPtr<AudioContext> AudioContext::createOfflineContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate)
-{
+PassRefPtr<AudioContext> AudioContext::createOfflineContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate, ExceptionCode& ec)
+{
+    ASSERT(document);
+
+    // FIXME: offline contexts have limitations on supported sample-rates.
+    // Currently all AudioContexts must have the same sample-rate.
+    HRTFDatabaseLoader* loader = HRTFDatabaseLoader::loader();
+    if (numberOfChannels > 10 || !isSampleRateRangeGood(sampleRate) || (loader && loader->databaseSampleRate() != sampleRate)) {
+        ec = SYNTAX_ERR;
+        return 0;
+    }
+
     return adoptRef(new AudioContext(document, numberOfChannels, numberOfFrames, sampleRate));
 }
@@ -237 +257 @@
 PassRefPtr<AudioBuffer> AudioContext::createBuffer(unsigned numberOfChannels, size_t numberOfFrames, double sampleRate)
 {
+    if (!isSampleRateRangeGood(sampleRate) || numberOfChannels > 10 || !numberOfFrames)
+        return 0;
+    
     return AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
 }

trunk/Source/WebCore/webaudio/AudioContext.h

@@ -72 +72 @@
 
     // Create an AudioContext for offline (non-realtime) rendering.
-    static PassRefPtr<AudioContext> createOfflineContext(Document*, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate);
+    static PassRefPtr<AudioContext> createOfflineContext(Document*, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate, ExceptionCode&);
 
     virtual ~AudioContext();