PatchGap
← WebKit — 2026-W38

b2dca993516ffb2cbdc016e4dc0df81e85e78f87  [CoreIPC] [UIP] UIProcess decodes WebContent-supplied image bytes with the unrestricted ImageIO codec set

severity medium class InputValidation confidence 0.55 signal score 11.06 Source/WebCore/editing
view commit ↗
Primitive: untrusted unsupported-type image bytes decoded by the privileged UIProcess (text attachments / saveImageToLibrary / share sheet)
Triage note: imageTypeForAttachmentData + isSupportedImageType gate drop non-web-safe image bytes before the UIProcess decodes them (AttributedString attachment, saveImageToLibrary, createCocoaImageRestrictedToSupportedTypes); attack-surface reduction against privileged image decoders but no concrete decoder bug is fixed in this diff.
Structural signals: smartptr_member_added (+6.47), null_guard (+2.59), area:Source/WebCore/editing (+2.0)

Commit message

[CoreIPC] [UIP] UIProcess decodes WebContent-supplied image bytes with the unrestricted ImageIO codec set
<https://bugs.webkit.org/show_bug.cgi?id=319411>
<rdar://174675851>

Reviewed by David Kilzer.

The WebContent and GPU processes restrict image decoding to the types
supported for web content, but the UIProcess does not, and it cannot do so
process-wide because it is the host application's process. As a result,
image bytes sent from the WebContent process to the UIProcess -- directly
via SharedMemory, or embedded as a file-wrapper attachment inside an
AttributedString -- get decoded with the full ImageIO codec set (PSD,
OpenEXR, camera RAW, JPEG 2000, etc.) rather than the web-safe subset. A
compromised WebContent process can use this to run codecs in the host
process that are never reached by normal web content.

Gate each affected UIProcess decode on WebCore::isSupportedImageType()
instead.

Test: Tools/TestWebKitAPI/Tests/WebCore/cocoa/AttributedStringFontCache.mm

* Source/WebCore/editing/cocoa/AttributedString.mm: When reconstructing an
NSTextAttachment, if the file-wrapper data is an image of a type not
supported for web content, drop it and substitute the missing-image
placeholder. Web-safe images and non-image file wrappers are unaffected.

* Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm: Decode the share
menu's image through createCocoaImageRestrictedToSupportedTypes().

* Source/WebKit/UIProcess/PageClient.h:
* Source/WebKit/UIProcess/ios/PageClientImplIOS.h:
* Source/WebKit/UIProcess/ios/PageClientImplIOS.mm: Copy the image out of
shared memory and only save it to the photo library if it is a supported
image type. Take the SharedBuffer by const reference since the method does
not take ownership of it.

* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm: Update the caller for the
saveImageToLibrary() signature change.

* Tools/TestWebKitAPI/Tests/WebCore/cocoa/AttributedStringFontCache.mm:
Added tests covering web-safe, unsupported-image, and non-image attachment
data.

Originally-landed-as: 316606.192@safari-7625-branch (eb9e464809b1). rdar://187506978
Canonical link: https://commits.webkit.org/321422@main

Before / after

Loading diff…
On This Page