Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 31f8a026714a04aa36545ad1aaea0e237f403a09
https://github.com/WebKit/WebKit/commit/31f8a026714a04aa36545ad1aaea0e237f403a09
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-24 (Fri, 24 Jul 2026)
Changed paths:
A LayoutTests/media/media-fragments/TC0096-expected.txt
A LayoutTests/media/media-fragments/TC0096.html
A LayoutTests/media/media-fragments/TC0097-expected.txt
A LayoutTests/media/media-fragments/TC0097.html
A LayoutTests/media/media-fragments/TC0098-expected.txt
A LayoutTests/media/media-fragments/TC0098.html
M LayoutTests/media/media-fragments/media-fragments.js
M Source/WebCore/html/MediaFragmentURIParser.cpp
Log Message:
-----------
MediaFragmentURIParser silently accepts overflowing NPT hours value instead
of rejecting the fragment
https://bugs.webkit.org/show_bug.cgi?id=318966
rdar://181820705
Reviewed by Chris Dumez.
In parseNPTTime(), the NPT hours field ("npt-hh = 1*DIGIT", any positive
number) was parsed with parseInteger<int>(digits1).value_or(0). When the
value exceeded the range of int, parseInteger returned nullopt and
value_or(0) silently coerced it to 0 hours, so a fragment such as
"t=99999999999:00:05" was accepted as a valid seek to 00:05 (5 seconds)
rather than being rejected. The same value1 is also used for plain
npt-sec fragments (e.g. "t=99999999999"), so that path was affected too.
Reject the fragment when the hours value fails to parse, consistent with
how the minutes and seconds fields are already validated.
Also fix a related integer overflow: the hours value was multiplied by
secondsPerHour (3600) using plain int arithmetic before being converted
to a double, so an in-range hours value like 1000000
(1000000 * 3600 = 3.6e9) could overflow INT_MAX and produce a wrong or
negative seek time via signed integer overflow. Compute the total in
double precision instead.
Tests: media/media-fragments/TC0096.html
media/media-fragments/TC0097.html
media/media-fragments/TC0098.html
* LayoutTests/media/media-fragments/TC0096-expected.txt: Added.
* LayoutTests/media/media-fragments/TC0096.html: Added.
* LayoutTests/media/media-fragments/TC0097-expected.txt: Added.
* LayoutTests/media/media-fragments/TC0097.html: Added.
* LayoutTests/media/media-fragments/TC0098-expected.txt: Added.
* LayoutTests/media/media-fragments/TC0098.html: Added.
* LayoutTests/media/media-fragments/media-fragments.js: Added TC0096,
TC0097, and TC0098, covering an out-of-range npt-hh value, an
out-of-range plain npt-sec value, and an in-range npt-hh value whose
multiplication by secondsPerHour would overflow a 32-bit int.
* Source/WebCore/html/MediaFragmentURIParser.cpp:
(WebCore::MediaFragmentURIParser::parseNPTTime): Return false when the
hours value overflows instead of defaulting it to 0. Compute the total
number of seconds using double arithmetic to avoid a signed-integer
overflow when multiplying the hours value by secondsPerHour. Removed
the now-unused secondsPerHour and secondsPerMinute constants.
Canonical link: https://commits.webkit.org/317869@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
