Bug 290201 – [Fuzz Blocker][CoreIPC][GPU] WTF::Vector initial capacity isn't validated in RemoteGraphicsContextGL

• Status: RESOLVED
• Resolution: FIXED
• Component: WebGL

rdar://146284403
(Radar originator: Jérémie Boutoille)

In `Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLFunctionsGenerated.h`, there is multiple time this code pattern:

```
    void getFloatv(uint32_t pname, size_t valueSize, CompletionHandler<void(std::span<const float>)>&& completionHandler)
    {
        assertIsCurrent(workQueue());
        Vector<GCGLfloat, 16> value(valueSize, 0);
        protectedContext()->getFloatv(pname, value);
        completionHandler(spanReinterpretCast<const float>(value.span()));
    }
```

`valueSize` is used without validation as the initial WTF::Vector capacity. This means that if a big value is provided, a crash occurs. It should be validated like this:

```
    void getFloatv(uint32_t pname, size_t valueSize, CompletionHandler<void(std::span<const float>)>&& completionHandler)
    {
        assertIsCurrent(workQueue());
        if(!WTF::isValidCapacityForVector<GCGLfloat>(valueSize)) { return; }
        Vector<GCGLfloat, 16> value(valueSize, 0);
        protectedContext()->getFloatv(pname, value);
        completionHandler(spanReinterpretCast<const float>(value.span()));
    }
```

This is not a security issue, but it’s currently blocking our fuzzer.

To reproduce:
1. Build WebKit with ASan enabled.
2. Run the command: ./WebKitTestRunner --internal-feature IPCTestingAPIEnabled --no-timeout gl.html
3. You should observe that the process crashes.

Created attachment 474678 [details]
Input for WebKitTestRunner

Created attachment 474679 [details]
Support javascript file

Pull request: https://github.com/WebKit/WebKit/pull/42831

[EWS]

Committed 292806@main (634d3c001793): <https://commits.webkit.org/292806@main>

Reviewed commits have been landed. Closing PR #42831 and removing active labels.