← WebKit — 2026-W36
d9c885fa52c898ea92adb57f11b09a5ad52c01cb VP8 Packetizer Heap Overflow via size_t-to-int Truncation in SplitAboutEqually
severity medium
class IntegerOverflow
confidence 0.7
signal score 6.3
Source/ThirdParty/libwebrtc
patch-now
Primitive: A size_t payload length cast to int can become negative and bypass the ==0 guard, driving SplitAboutEqually with a negative length.
Triage note: The RC_REMOVE_SEC_ACCEL_3-guarded fix changes the guard in RtpPacketizer::SplitAboutEqually from `payload_len == 0` to `payload_len <= 0`, with the added comment that payload_len comes from a size_t given via RTCEncodedVideoFrame and oversized payloads must be rejected. A value > INT_MAX becomes negative and previously slipped past the zero check.
Triage note: The RC_REMOVE_SEC_ACCEL_3-guarded fix changes the guard in RtpPacketizer::SplitAboutEqually from `payload_len == 0` to `payload_len <= 0`, with the added comment that payload_len comes from a size_t given via RTCEncodedVideoFrame and oversized payloads must be rejected. A value > INT_MAX becomes negative and previously slipped past the zero check.
Structural signals: msg_strong (+3.0), msg_medium (+2.0), surgical (+1.3)
Commit message
VP8 Packetizer Heap Overflow via size_t-to-int Truncation in SplitAboutEqually
rdar://180200591
Reviewed by Jer Noble.
RtpPacketizer::SplitAboutEqually takes its payload_len as int, but every caller passes a size_t.
RTCRtpScriptTransform lets web content replace RTCEncodedVideoFrame.data with an arbitrary ArrayBuffer up to MAX_ARRAY_BUFFER_SIZE.
This narrows to negative integers.
We make sure that these oversized payloads are rejected by widening the current webkit specific check.
Test: http/wpt/webrtc/script-transform-oversized-frame.html
* LayoutTests/http/wpt/webrtc/script-transform-oversized-frame-expected.txt: Added.
* LayoutTests/http/wpt/webrtc/script-transform-oversized-frame-worker.js: Added.
(onrtctransform.event.process):
* LayoutTests/http/wpt/webrtc/script-transform-oversized-frame.html: Added.
* Source/ThirdParty/libwebrtc/Source/webrtc/modules/rtp_rtcp/source/rtp_format.cc:
Identifier: 316606.579@safari-7625-branch
Before / after
Loading diff…
On This Page