[webkit-changes] [WebKit/WebKit] 971ab4: HeapBufferOverflow in computeSampleUsingLinearInte...

[Jean-Yves Avenard]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 971ab40cd8de9afbe40334360e07230d1f76d0ed
      https://github.com/WebKit/WebKit/commit/971ab40cd8de9afbe40334360e07230d1f76d0ed
  Author: Jean-Yves Avenard <jya at apple.com>
  Date:   2024-08-05 (Mon, 05 Aug 2024)

  Changed paths:
    A LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt
    A LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html
    M Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp

  Log Message:
  -----------
  HeapBufferOverflow in computeSampleUsingLinearInterpolation
https://bugs.webkit.org/show_bug.cgi?id=275431
rdar://125617812

Reviewed by Youenn Fablet.

Add boundary check.
This is a copy of blink code for that same function.
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/modules/webaudio/audio_buffer_source_handler.cc;l=336-341

* LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash-expected.txt: Added.
* LayoutTests/webaudio/crashtest/audiobuffer-sourcenode-resampler-crash.html: Added.
* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:
(WebCore::AudioBufferSourceNode::renderFromBuffer):

Originally-landed-as: 272448.1085 at safari-7618-branch (ff52ff7cb64e). rdar://132956456
Canonical link: https://commits.webkit.org/281865@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications