42 lines
1.9 KiB
Diff
42 lines
1.9 KiB
Diff
From 2fe5ae29a5f6434ef456afe9673a4f400ec63848 Mon Sep 17 00:00:00 2001
|
|
From: Jean-Yves Avenard <jya@apple.com>
|
|
Date: Fri, 14 Jun 2024 16:08:19 -0700
|
|
Subject: [PATCH] Cherry-pick 272448.1085@safari-7618.3.10-branch
|
|
(ff52ff7cb64e). https://bugs.webkit.org/show_bug.cgi?id=275431
|
|
|
|
HeapBufferOverflow in computeSampleUsingLinearInterpolation
|
|
https://bugs.webkit.org/show_bug.cgi?id=275431
|
|
rdar://125617812
|
|
|
|
Reviewed by Youenn Fablet.
|
|
|
|
Add boundary check.
|
|
This is a copy of blink code for that same function.
|
|
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/modules/webaudio/audio_buffer_source_handler.cc;l=336-341
|
|
|
|
* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:
|
|
(WebCore::AudioBufferSourceNode::renderFromBuffer):
|
|
|
|
Canonical link: https://commits.webkit.org/274313.347@webkitglib/2.44
|
|
---
|
|
.../webaudio/AudioBufferSourceNode.cpp | 6 +++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
|
|
index 298bd48cdff5..740b793e0ec5 100644
|
|
--- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
|
|
+++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
|
|
@@ -350,6 +350,12 @@ bool AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
|
|
if (readIndex2 >= maxFrame)
|
|
readIndex2 = m_isLooping ? minFrame : readIndex;
|
|
|
|
+ // Final sanity check on buffer access.
|
|
+ // FIXME: as an optimization, try to get rid of this inner-loop check and
|
|
+ // put assertions and guards before the loop.
|
|
+ if (readIndex >= bufferLength || readIndex2 >= bufferLength)
|
|
+ break;
|
|
+
|
|
// Linear interpolation.
|
|
for (unsigned i = 0; i < numberOfChannels; ++i) {
|
|
float* destination = destinationChannels[i];
|