Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 37384dc63e5df1d8d5e2a6609b3998ae351ce2b5
https://github.com/WebKit/WebKit/commit/37384dc63e5df1d8d5e2a6609b3998ae351ce2b5
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-12 (Sun, 12 Jul 2026)
Changed paths:
M Source/WebCore/svg/animation/SVGSMILElement.cpp
Log Message:
-----------
Add iteration bounds to SVGSMILElement interval-resolution loops to prevent
potential hangs
https://bugs.webkit.org/show_bug.cgi?id=319207
rdar://182059570
Reviewed by Taher Ali.
Merge: https://chromium-review.googlesource.com/c/chromium/src/+/1937067
SVGSMILElement::resolveInterval() and seekToIntervalCorrespondingToTime()
each drive an unbounded `while (true)` loop whose termination depends
entirely on the begin/end instance-time lists advancing on every pass.
A malformed or non-advancing time list can therefore spin these loops
indefinitely, pinning the main thread (see the equivalent Blink hang,
crbug.com/1021630).
Defensively bound both walks with an iteration cap of
max(m_beginTimes.size() * 4, 1000000) -- matching Blink's kMaxIterations
-- then ASSERT_NOT_REACHED() and fall out gracefully on overflow:
resolveInterval() leaves the interval unresolved and
seekToIntervalCorrespondingToTime() stops seeking at the current
interval.
The cap is deliberately loose so no valid content can ever reach it:
- m_beginTimes.size() * 4 scales the bound with the actual input. A
legitimate walk advances about one iteration per begin instance time,
plus a small constant multiple for the end-time refinement retries;
4x leaves headroom over that.
- 1000000 is an absolute floor. When the begin list is small or empty,
size * 4 would be tiny (or 0) and could false-positive on walks
driven by dynamically-added or event-based instance times that are
not reflected in m_beginTimes.size(). The 1M floor guarantees a large
ceiling regardless of list size.
No behavior change for valid animations; no new tests since the bound is
unreachable by well-formed timing input.
* Source/WebCore/svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::resolveInterval):
(WebCore::SVGSMILElement::seekToIntervalCorrespondingToTime):
Canonical link: https://commits.webkit.org/317014@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
