[webkit-changes] [WebKit/WebKit] ef779c: [WebGPU] Check offset plus format size is valid

[mwyrzykowski]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ef779cb00ce3c33cab65e99235302c90c1f591b4
      https://github.com/WebKit/WebKit/commit/ef779cb00ce3c33cab65e99235302c90c1f591b4
  Author: Mike Wyrzykowski <mwyrzykowski at apple.com>
  Date:   2024-09-26 (Thu, 26 Sep 2024)

  Changed paths:
    A LayoutTests/fast/webgpu/nocrash/webgpu_oob_attribute_offset-expected.txt
    A LayoutTests/fast/webgpu/nocrash/webgpu_oob_attribute_offset.html
    M Source/WebGPU/WebGPU/RenderPipeline.mm

  Log Message:
  -----------
  [WebGPU] Check offset plus format size is valid
https://bugs.webkit.org/show_bug.cgi?id=280290
rdar://136576097

Reviewed by Tadeu Zagallo.

Passing values exceeding 2^53 - 1 could result in an
overflow and lead to an out of bounds access in the shader.

* Source/WebGPU/WebGPU/RenderPipeline.mm:
(WebGPU::createVertexDescriptor):
Use checked arithmetic.

* LayoutTests/fast/webgpu/nocrash/webgpu_oob_attribute_offset-expected.txt: Added.
* LayoutTests/fast/webgpu/nocrash/webgpu_oob_attribute_offset.html: Added.
Add regression test.

Canonical link: https://commits.webkit.org/284294@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications