Bug 289947

Summary: [CoreIPC] [GPU] WebCore::SVGFilter expression/effects members are not validated
Product: WebKit Reporter: Jon Butler <jonbutler>
Component: New BugsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Jon Butler
Reported 2025-03-18 02:50:22 PDT
`WebCore::SVGFilter` can be serialized over CoreIPC. Among other fields it contains `expression` and `effects` fields. `expression` is a vector of `WebCore::SVGFilterExpressionTerm` and `effects` a vector of `WebCore::FilterEffect`. `WebCore::SVGFilterExpressionTerm` refers to `effects` members with the `index` property. Because `expression` indexes are not validated, an OOB may occur at `m_effects[term.index]`. However, thanks to the default Vector `OverflowHandler` being `CrashOnOverflow`, the bug cannot be exploited and only makes the GPU process crashing.
Attachments
Jon Butler
Comment 1 2025-03-18 02:55:59 PDT
Jon Butler
Comment 2 2025-03-18 03:13:14 PDT
EWS
Comment 3 2025-03-21 10:00:10 PDT
Committed 292483@main (45047bcfe94e): <https://commits.webkit.org/292483@main> Reviewed commits have been landed. Closing PR #42610 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.