Verified Commit 7f71204b authored by Jan Grulich's avatar Jan Grulich Committed by ma1
Browse files

Bug 2054625 - WebRTC backport: Video capture: validate PipeWire camera frame... 

Bug 2054625 - WebRTC backport: Video capture: validate PipeWire camera frame size to prevent OOB read r=pehrsons

Check spa_chunk::size is not larger than mmap'ed buffer, which would
lead to an out-of-bounds read when the frame is copied. Validate that
chunk offset + size does not exceed maxsize before processing.

This is a simple backport of an WebRTC upstream change.

Upstream commit: 612430e8266881eaff478b0000cacc90fb71c918

Differential Revision: https://phabricator.services.mozilla.com/D316000
parent d2276817

third_party/libwebrtc/modules/video_capture/linux/video_capture_pipewire.cc

+8 −0
Original line number Diff line number Diff line
@@ -443,6 +443,14 @@ void VideoCaptureModulePipeWire::ProcessBuffers() { 
      continue;

    }



    if (static_cast<uint64_t>(spaBuffer->datas[0].chunk->offset) +

            spaBuffer->datas[0].chunk->size >

        spaBuffer->datas[0].maxsize) {

      RTC_LOG(LS_ERROR) << "Dropping frame with invalid size";

      pw_stream_queue_buffer(stream_, buffer);

      continue;

    }



    if (spaBuffer->datas[0].type == SPA_DATA_DmaBuf ||

        spaBuffer->datas[0].type == SPA_DATA_MemFd) {

      ScopedBuf frame;

third_party/libwebrtc/moz-patch-stack/612430e826.no-op-cherry-pick-msg

0 → 100644
+1 −0
Original line number Diff line number Diff line 
We cherry-picked this in bug 2054625.
 
 No newline at end of file