Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ce589a4f52d7f6ff196f12d2eedd456e085bbf0d
https://github.com/WebKit/WebKit/commit/ce589a4f52d7f6ff196f12d2eedd456e085bbf0d
Author: Mike Wyrzykowski <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M Source/WebGPU/WebGPU/CommandEncoder.mm
M Source/WebKit/GPUProcess/graphics/WebGPU/RemoteBuffer.cpp
Log Message:
-----------
m_bufferMapCount via getMappedRange State Confusion Leads to GPU OOB
https://bugs.webkit.org/show_bug.cgi?id=313551
rdar://174670066
Reviewed by Tadeu Zagallo.
>From the JS layer it is impossible to reach a negative
mapped buffer count because the web content process will
reject unmapping a buffer which is not mapped.
But a compromised process capable of sending IPC messages directly
to the GPU process can achieve that.
Prevent that by ensuring the map buffer count is never negative
as it would allow a currently mapped buffer to be modified
while the GPU is simultaneously writing to it.
* Source/WebGPU/WebGPU/CommandEncoder.mm:
(WebGPU::CommandEncoder::decrementBufferMapCount):
* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteBuffer.cpp:
(WebKit::RemoteBuffer::getMappedRange):
Originally-landed-as: 305413.753@safari-7624-branch (7941fb9f0d02).
rdar://180437592
Canonical link: https://commits.webkit.org/316270@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
