[Webkit-unassigned] [Bug 258222] New: IPC deserialization: Clip IntRect rather than fail to decode entirely

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=258222

            Bug ID: 258222
           Summary: IPC deserialization: Clip IntRect rather than fail to
                    decode entirely
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Keywords: InRadar
          Severity: Normal
          Priority: P2
         Component: WebKit2
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: a_protyasha at apple.com
                CC: kkinnunen at apple.com,
                    webkit-bug-importer at group.apple.com

We hardened IntRect decoding by using IntRect::isValid as a validator in https://commits.webkit.org/262412@main, however this has the inadvertent effect of terminating a sending process if they send a degenerately large IntRect (i.e. one that overflows at x + width or y + height and thus fails IntRect::isValid).

Instead of failing to decode entirely, we should clip the IntRect (i.e. prevent overflows, thus pass IntRect::isValid) while decoding.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230616/2f1193b2/attachment.htm>