From e4c82db8a7c3273fe30bc99880fcdcd7ab061924 Mon Sep 17 00:00:00 2001 From: Rohini Sangam Date: Fri, 3 Jan 2025 10:57:53 +0530 Subject: [PATCH] webkitgtk: Security fix for CVE-2024-40776 and CVE-2024-40780 CVE fixed: - CVE-2024-40776 webkitgtk: Use after free may lead to Remote Code Execution - CVE-2024-40780 webkitgtk: Out-of-bounds read was addressed with improved bounds checking Upstream-Status: Backport from https://github.com/WebKit/WebKit/commit/b951404ea74ae432312a83138f5c8945a0d09e1b and https://github.com/WebKit/WebKit/commit/e83e4c7460972898dc06a5f5ab36eed7c6b101b5 Signed-off-by: Rohini Sangam Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman --- .../webkit/webkitgtk/CVE-2024-40776.patch | 141 ++++++++++++++++++ .../webkit/webkitgtk/CVE-2024-40780.patch | 94 ++++++++++++ meta/recipes-sato/webkit/webkitgtk_2.36.8.bb | 2 + 3 files changed, 237 insertions(+) create mode 100644 meta/recipes-sato/webkit/webkitgtk/CVE-2024-40776.patch create mode 100644 meta/recipes-sato/webkit/webkitgtk/CVE-2024-40780.patch diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2024-40776.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2024-40776.patch new file mode 100644 index 00000000000..60f18168fe7 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2024-40776.patch @@ -0,0 +1,141 @@ +From b951404ea74ae432312a83138f5c8945a0d09e1b Mon Sep 17 00:00:00 2001 +From: Jean-Yves Avenard +Date: Wed, 24 Apr 2024 19:01:06 -0700 +Subject: [PATCH] CVE-2024-40776: Always copy all audio channels to the AudioBus +to guarantee data lifetime. + +Upstream-Status: Backport from https://github.com/WebKit/WebKit/commit/b951404ea74ae432312a83138f5c8945a0d09e1b +CVE: CVE-2024-40776 + +Signed-off-by: Rohini Sangam +--- + ...et-concurrent-resampler-crash-expected.txt | 1 + + ...dioworklet-concurrent-resampler-crash.html | 44 +++++++++++++++++++ + .../platform/audio/MultiChannelResampler.cpp | 21 ++------- + .../platform/audio/MultiChannelResampler.h | 2 - + 4 files changed, 48 insertions(+), 20 deletions(-) + create mode 100644 LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt + create mode 100644 LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html + +diff --git a/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt +new file mode 100644 +index 00000000..654ddf7f +--- /dev/null ++++ b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash-expected.txt +@@ -0,0 +1 @@ ++This test passes if it does not crash. +diff --git a/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html +new file mode 100644 +index 00000000..b3ab181d +--- /dev/null ++++ b/LayoutTests/webaudio/crashtest/audioworklet-concurrent-resampler-crash.html +@@ -0,0 +1,44 @@ ++ ++ ++ ++ ++ ++

This test passes if it does not crash.

++ ++ ++ +diff --git a/Source/WebCore/platform/audio/MultiChannelResampler.cpp b/Source/WebCore/platform/audio/MultiChannelResampler.cpp +index 1dadc58c..13db6f26 100644 +--- a/Source/WebCore/platform/audio/MultiChannelResampler.cpp ++++ b/Source/WebCore/platform/audio/MultiChannelResampler.cpp +@@ -41,18 +41,8 @@ namespace WebCore { + MultiChannelResampler::MultiChannelResampler(double scaleFactor, unsigned numberOfChannels, unsigned requestFrames, Function&& provideInput) + : m_numberOfChannels(numberOfChannels) + , m_provideInput(WTFMove(provideInput)) +- , m_multiChannelBus(AudioBus::create(numberOfChannels, requestFrames, false)) ++ , m_multiChannelBus(AudioBus::create(numberOfChannels, requestFrames)) + { +- // As an optimization, we will use the buffer passed to provideInputForChannel() as channel memory for the first channel so we +- // only need to allocate memory if there is more than one channel. +- if (numberOfChannels > 1) { +- m_channelsMemory.reserveInitialCapacity(numberOfChannels - 1); +- for (unsigned channelIndex = 1; channelIndex < numberOfChannels; ++channelIndex) { +- m_channelsMemory.uncheckedAppend(makeUnique(requestFrames)); +- m_multiChannelBus->setChannelMemory(channelIndex, m_channelsMemory.last()->data(), requestFrames); +- } +- } +- + // Create each channel's resampler. + for (unsigned channelIndex = 0; channelIndex < numberOfChannels; ++channelIndex) + m_kernels.append(makeUnique(scaleFactor, requestFrames, std::bind(&MultiChannelResampler::provideInputForChannel, this, std::placeholders::_1, std::placeholders::_2, channelIndex))); +@@ -89,15 +79,10 @@ void MultiChannelResampler::process(AudioBus* destination, size_t framesToProces + void MultiChannelResampler::provideInputForChannel(float* buffer, size_t framesToProcess, unsigned channelIndex) + { + ASSERT(channelIndex < m_multiChannelBus->numberOfChannels()); +- ASSERT(framesToProcess == m_multiChannelBus->length()); ++ ASSERT(framesToProcess <= m_multiChannelBus->length()); + +- if (!channelIndex) { +- // As an optimization, we use the provided buffer as memory for the first channel in the AudioBus. This avoids +- // having to memcpy() for the first channel. +- m_multiChannelBus->setChannelMemory(0, buffer, framesToProcess); ++ if (!channelIndex) + m_provideInput(m_multiChannelBus.get(), framesToProcess); +- return; +- } + + // Copy the channel data from what we received from m_multiChannelProvider. + memcpy(buffer, m_multiChannelBus->channel(channelIndex)->data(), sizeof(float) * framesToProcess); +diff --git a/Source/WebCore/platform/audio/MultiChannelResampler.h b/Source/WebCore/platform/audio/MultiChannelResampler.h +index e96cc56b..274fe364 100644 +--- a/Source/WebCore/platform/audio/MultiChannelResampler.h ++++ b/Source/WebCore/platform/audio/MultiChannelResampler.h +@@ -29,7 +29,6 @@ + #ifndef MultiChannelResampler_h + #define MultiChannelResampler_h + +-#include "AudioArray.h" + #include + #include + #include +@@ -62,7 +61,6 @@ private: + size_t m_outputFramesReady { 0 }; + Function m_provideInput; + RefPtr m_multiChannelBus; +- Vector> m_channelsMemory; + }; + + } // namespace WebCore +-- +2.35.7 + diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2024-40780.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2024-40780.patch new file mode 100644 index 00000000000..ab41213d7d6 --- /dev/null +++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2024-40780.patch @@ -0,0 +1,94 @@ +From e83e4c7460972898dc06a5f5ab36eed7c6b101b5 Mon Sep 17 00:00:00 2001 +From: Jer Noble +Date: Tue, 11 Jun 2024 11:54:06 -0700 +Subject: [PATCH] CVE-2024-40780: Add check in AudioBufferSourceNode::renderFromBuffer() +when detune is set to large negative value + +Upstream-Status: Backport from https://github.com/WebKit/WebKit/commit/e83e4c7460972898dc06a5f5ab36eed7c6b101b5 +CVE: CVE-2024-40780 + +Signed-off-by: Rohini Sangam +--- + ...buffersourcenode-detune-crash-expected.txt | 10 +++++++ + .../audiobuffersourcenode-detune-crash.html | 30 +++++++++++++++++++ + .../webaudio/AudioBufferSourceNode.cpp | 7 +++++ + 3 files changed, 47 insertions(+) + create mode 100644 LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt + create mode 100644 LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html + +diff --git a/LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt +new file mode 100644 +index 00000000..914ba0b1 +--- /dev/null ++++ b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash-expected.txt +@@ -0,0 +1,10 @@ ++Attempting to create a AudioBufferSourceNode with a large negative detune value should not crash. ++ ++On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". ++ ++ ++PASS Test passed because it did not crash. ++PASS successfullyParsed is true ++ ++TEST COMPLETE ++ +diff --git a/LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html +new file mode 100644 +index 00000000..e8af579d +--- /dev/null ++++ b/LayoutTests/webaudio/audiobuffersourcenode-detune-crash.html +@@ -0,0 +1,30 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp +index 689d37a1..f68e7ff5 100644 +--- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp ++++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp +@@ -327,9 +327,16 @@ bool AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination + virtualReadIndex = readIndex; + } else if (!pitchRate) { + unsigned readIndex = static_cast(virtualReadIndex); ++ int deltaFrames = static_cast(virtualDeltaFrames); ++ maxFrame = static_cast(virtualMaxFrame); ++ ++ if (readIndex >= maxFrame) ++ readIndex -= deltaFrames; + + for (unsigned i = 0; i < numberOfChannels; ++i) + std::fill_n(destinationChannels[i] + writeIndex, framesToProcess, sourceChannels[i][readIndex]); ++ ++ virtualReadIndex = readIndex; + } else if (reverse) { + unsigned maxFrame = static_cast(virtualMaxFrame); + unsigned minFrame = static_cast(floorf(virtualMinFrame)); +-- +2.35.7 + diff --git a/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb b/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb index 4849ee50ff5..2006d1d55e3 100644 --- a/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb +++ b/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb @@ -26,6 +26,8 @@ SRC_URI = "https://www.webkitgtk.org/releases/${BP}.tar.xz \ file://CVE-2023-32439.patch \ file://CVE-2024-40779.patch \ file://0d3344e17d258106617b0e6d783d073b188a2548.patch \ + file://CVE-2024-40776.patch \ + file://CVE-2024-40780.patch \ " SRC_URI[sha256sum] = "0ad9fb6bf28308fe3889faf184bd179d13ac1b46835d2136edbab2c133d00437" -- 2.47.3