← WebKit — 2026-W41
790f56e77cc49b1f630703b3b485bb073bbe8ad8 WebCodecs VP8/VP9/AV1 encoder encodes uninitialized data when given 10-bit frames
severity low
class InputValidation
confidence 0.35
signal score 6.25
Source/WebCore/platform
Primitive: null pixel-buffer deref / unhandled pixel formats in VPX encoder
Triage note: LibWebRTCVPXInternalVideoEncoder::encode() now handles non-NV12/high-bit-depth pixel formats by converting to 8-bit NV12 and adds 'if (!buffer) return reject' before webrtc::pixelBufferToFrame(buffer.get()). The null check avoids a null-buffer deref when ImageTransferSessionVT::convertPixelBuffer fails, but it is a robustness/DoS-class fix, not memory corruption.
Triage note: LibWebRTCVPXInternalVideoEncoder::encode() now handles non-NV12/high-bit-depth pixel formats by converting to 8-bit NV12 and adds 'if (!buffer) return reject' before webrtc::pixelBufferToFrame(buffer.get()). The null check avoids a null-buffer deref when ImageTransferSessionVT::convertPixelBuffer fails, but it is a robustness/DoS-class fix, not memory corruption.
Structural signals: null_guard (+1.95), msg_strong (+3.0), surgical (+1.3)
Commit message
WebCodecs VP8/VP9/AV1 encoder encodes uninitialized data when given 10-bit frames
https://bugs.webkit.org/show_bug.cgi?id=325886
rdar://188868992
Reviewed by Youenn Fablet.
LibWebRTCVPXInternalVideoEncoder::encode() converted RGB input to NV12 and passed every other pixel
buffer to libwebrtc as a native buffer. The encoders then called ToI420(), and
-[RTCCVPixelBuffer toI420] only handles 8-bit NV12 and 32-bit RGB: for any other format it returned
the I420 buffer it had allocated without filling it, so 10-bit frames, such as those produced by the
VP9 profile 2 decoder, were encoded from uninitialized memory.
Pixel buffers that are not 8-bit NV12 are now converted to BT709 8-bit NV12 with the frame's range
before being handed to libwebrtc, and the frame's color space is set to BT709 so that the encoder and
the reported decoder configuration describe the converted pixels. The first such conversion is logged
once per encoder. The encode fails if there is no buffer to encode.
* LayoutTests/http/wpt/webcodecs/encoder-from-10-bit-frame-expected.txt: Added.
* LayoutTests/http/wpt/webcodecs/encoder-from-10-bit-frame.html: Added.
* LayoutTests/platform/glib/TestExpectations:
* Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoEncoder.cpp:
(WebCore::LibWebRTCVPXInternalVideoEncoder::encode): Convert non-NV12 input to BT709 NV12, signal the
BT709 color space and log the conversion once. Reject the encode when there is no buffer.
Canonical link: https://commits.webkit.org/322968@main
Before / after
Loading diff…
On This Page