From 2fe5ae29a5f6434ef456afe9673a4f400ec63848 Mon Sep 17 00:00:00 2001 From: Jean-Yves Avenard Date: Fri, 14 Jun 2024 16:08:19 -0700 Subject: [PATCH] Cherry-pick 272448.1085@safari-7618.3.10-branch (ff52ff7cb64e). https://bugs.webkit.org/show_bug.cgi?id=275431 HeapBufferOverflow in computeSampleUsingLinearInterpolation https://bugs.webkit.org/show_bug.cgi?id=275431 rdar://125617812 Reviewed by Youenn Fablet. Add boundary check. This is a copy of blink code for that same function. https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/modules/webaudio/audio_buffer_source_handler.cc;l=336-341 * LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt: Added. * LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html: Added. * Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp: (WebCore::AudioBufferSourceNode::renderFromBuffer): Canonical link: https://commits.webkit.org/274313.347@webkitglib/2.44 --- ...er-sourcenode-resampler-crash-expected.txt | 1 + ...udiobuffer-sourcenode-resampler-crash.html | 25 +++++++++++++++++++ .../webaudio/AudioBufferSourceNode.cpp | 6 +++++ 3 files changed, 32 insertions(+) create mode 100644 LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt create mode 100644 LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html diff --git a/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt new file mode 100644 index 000000000000..654ddf7f17ef --- /dev/null +++ b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt @@ -0,0 +1 @@ +This test passes if it does not crash. diff --git a/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html new file mode 100644 index 000000000000..5fb2dd8c8a5f --- /dev/null +++ b/LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html @@ -0,0 +1,25 @@ + + + + + +

This test passes if it does not crash.

+ + + diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp index 298bd48cdff5..740b793e0ec5 100644 --- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp +++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp @@ -350,6 +350,12 @@ bool AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination if (readIndex2 >= maxFrame) readIndex2 = m_isLooping ? minFrame : readIndex; + // Final sanity check on buffer access. + // FIXME: as an optimization, try to get rid of this inner-loop check and + // put assertions and guards before the loop. + if (readIndex >= bufferLength || readIndex2 >= bufferLength) + break; + // Linear interpolation. for (unsigned i = 0; i < numberOfChannels; ++i) { float* destination = destinationChannels[i]; -- 2.45.2