AudioResamplerKernel::getSourceSpan() computes how many input (source) frames it must read to produce a requested block of output frames, then returns a std::span<float> over the source buffer describing that region. The frame count was computed as ‘size_t framesNeeded = 1 + endIndex - m_fillIndex;’, where endIndex is the highest source index needed for this output block and m_fillIndex is the number of source frames already buffered from the previous call (the ‘+1’ accounts for filling up to and including endIndex). This arithmetic silently assumes the invariant 1 + endIndex >= m_fillIndex. If that assumption is violated — i.e. m_fillIndex exceeds 1 + endIndex, which can arise from a crafted combination of resampling rate/scale factor, buffer state, and framesToProcess — the subtraction underflows. Because framesNeeded is an unsigned size_t, the underflow wraps to a near-SIZE_MAX value rather than going negative. That gigantic framesNeeded is then written through *numberOfSourceFramesNeededP and used to size/derive the returned source span, so downstream consumers read far past the end of the actual source buffer: an out-of-bounds read whose length is effectively unbounded, producing a crash (denial of service, as the CVE states).

The fix adds <wtf/CheckedArithmetic.h> and replaces the raw subtraction with WTF::safeSub(1 + endIndex, m_fillIndex, framesNeeded); if the checked subtraction underflows it returns false and getSourceSpan() returns an empty span (‘return { };’) instead of propagating a wrapped length. This restores the invariant by refusing to produce a source span (and refusing to report a frame count) when the computed need would be negative, converting a would-be OOB access into a benign empty-span early return. The precise upstream conditions that let m_fillIndex exceed endIndex+1 are not in the shown diff (only getSourceSpan is changed), so the exact trigger state is an inference from the arithmetic and the resampler’s buffering model.

The primitive is an out-of-bounds read with an attacker-influenced but essentially unbounded length (a wrapped size_t), which reliably faults on unmapped memory and yields a controlled crash — matching the CVE’s denial-of-service classification. It sits in the audio-rendering path within the sandboxed WebContent process (or the media/GPU audio path in configurations where resampling runs there), not the more privileged Network process. While large OOB reads can sometimes be shaped into information disclosure, the diff and the DoS description point to a crash rather than a reliable read primitive, and there is no write, so escalation to memory corruption / RCE from this bug alone is not indicated.