summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-sato/webkit/webkitgtk/CVE-2022-48503.patch225
-rw-r--r--meta/recipes-sato/webkit/webkitgtk_2.36.8.bb1
2 files changed, 226 insertions, 0 deletions
diff --git a/meta/recipes-sato/webkit/webkitgtk/CVE-2022-48503.patch b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-48503.patch
new file mode 100644
index 0000000000..b67751736d
--- /dev/null
+++ b/meta/recipes-sato/webkit/webkitgtk/CVE-2022-48503.patch
@@ -0,0 +1,225 @@
1From 612c245823a515c8c70c2ad486957bd8a850f0f9 Mon Sep 17 00:00:00 2001
2From: Yusuke Suzuki <ysuzuki@apple.com>
3Date: Tue, 5 Sep 2023 08:40:19 +0000
4Subject: [PATCH] [JSC] Refactor wasm section ordering code
5 https://bugs.webkit.org/show_bug.cgi?id=241931 rdar://83326477
6
7Reviewed by Keith Miller.
8
9This patch refactors existing validateOrder code since it is too adhoc right now.
10
11* Source/JavaScriptCore/wasm/WasmModuleInformation.h:
12(JSC::Wasm::ModuleInformation::dataSegmentsCount const):
13* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
14(JSC::Wasm::SectionParser::parseData):
15(JSC::Wasm::SectionParser::parseDataCount):
16* Source/JavaScriptCore/wasm/WasmSectionParser.h:
17* Source/JavaScriptCore/wasm/WasmSections.h:
18(JSC::Wasm::orderingNumber):
19(JSC::Wasm::isKnownSection):
20(JSC::Wasm::validateOrder):
21(JSC::Wasm::makeString):
22* Source/JavaScriptCore/wasm/WasmStreamingParser.cpp:
23(JSC::Wasm::StreamingParser::parseSectionPayload):
24(JSC::Wasm::StreamingParser::finalize):
25
26Canonical link: https://commits.webkit.org/251800@main
27
28CVE: CVE-2022-48503
29
30Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/612c245823a515c8c70c2ad486957bd8a850f0f9]
31
32Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
33---
34 .../wasm/WasmModuleInformation.h | 4 +-
35 .../JavaScriptCore/wasm/WasmSectionParser.cpp | 3 ++
36 .../JavaScriptCore/wasm/WasmSectionParser.h | 2 +-
37 Source/JavaScriptCore/wasm/WasmSections.h | 52 +++++++++++--------
38 .../wasm/WasmStreamingParser.cpp | 11 +++-
39 5 files changed, 45 insertions(+), 27 deletions(-)
40
41diff --git a/Source/JavaScriptCore/wasm/WasmModuleInformation.h b/Source/JavaScriptCore/wasm/WasmModuleInformation.h
42index ae6bbeed..f9f1baf7 100644
43--- a/Source/JavaScriptCore/wasm/WasmModuleInformation.h
44+++ b/Source/JavaScriptCore/wasm/WasmModuleInformation.h
45@@ -86,7 +86,7 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> {
46 uint32_t memoryCount() const { return memory ? 1 : 0; }
47 uint32_t tableCount() const { return tables.size(); }
48 uint32_t elementCount() const { return elements.size(); }
49- uint32_t dataSegmentsCount() const { return numberOfDataSegments; }
50+ uint32_t dataSegmentsCount() const { return numberOfDataSegments.value_or(0); }
51
52 const TableInformation& table(unsigned index) const { return tables[index]; }
53
54@@ -131,7 +131,7 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> {
55 Vector<CustomSection> customSections;
56 Ref<NameSection> nameSection;
57 BranchHints branchHints;
58- uint32_t numberOfDataSegments { 0 };
59+ std::optional<uint32_t> numberOfDataSegments;
60
61 BitVector m_declaredFunctions;
62 BitVector m_declaredExceptions;
63diff --git a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
64index 5b511811..c55ee3c0 100644
65--- a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
66+++ b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
67@@ -768,6 +768,8 @@ auto SectionParser::parseData() -> PartialResult
68 uint32_t segmentCount;
69 WASM_PARSER_FAIL_IF(!parseVarUInt32(segmentCount), "can't get Data section's count");
70 WASM_PARSER_FAIL_IF(segmentCount > maxDataSegments, "Data section's count is too big ", segmentCount, " maximum ", maxDataSegments);
71+ if (m_info->numberOfDataSegments)
72+ WASM_PARSER_FAIL_IF(segmentCount != m_info->numberOfDataSegments.value(), "Data section's count ", segmentCount, " is different from Data Count section's count ", m_info->numberOfDataSegments.value());
73 WASM_PARSER_FAIL_IF(!m_info->data.tryReserveCapacity(segmentCount), "can't allocate enough memory for Data section's ", segmentCount, " segments");
74
75 for (uint32_t segmentNumber = 0; segmentNumber < segmentCount; ++segmentNumber) {
76@@ -847,6 +849,7 @@ auto SectionParser::parseDataCount() -> PartialResult
77 {
78 uint32_t numberOfDataSegments;
79 WASM_PARSER_FAIL_IF(!parseVarUInt32(numberOfDataSegments), "can't get Data Count section's count");
80+ WASM_PARSER_FAIL_IF(numberOfDataSegments > maxDataSegments, "Data Count section's count is too big ", numberOfDataSegments , " maximum ", maxDataSegments);
81
82 m_info->numberOfDataSegments = numberOfDataSegments;
83 return { };
84diff --git a/Source/JavaScriptCore/wasm/WasmSectionParser.h b/Source/JavaScriptCore/wasm/WasmSectionParser.h
85index 91fd3ed8..4d7dcbac 100644
86--- a/Source/JavaScriptCore/wasm/WasmSectionParser.h
87+++ b/Source/JavaScriptCore/wasm/WasmSectionParser.h
88@@ -44,7 +44,7 @@ public:
89 {
90 }
91
92-#define WASM_SECTION_DECLARE_PARSER(NAME, ID, DESCRIPTION) PartialResult WARN_UNUSED_RETURN parse ## NAME();
93+#define WASM_SECTION_DECLARE_PARSER(NAME, ID, ORDERING, DESCRIPTION) PartialResult WARN_UNUSED_RETURN parse ## NAME();
94 FOR_EACH_KNOWN_WASM_SECTION(WASM_SECTION_DECLARE_PARSER)
95 #undef WASM_SECTION_DECLARE_PARSER
96
97diff --git a/Source/JavaScriptCore/wasm/WasmSections.h b/Source/JavaScriptCore/wasm/WasmSections.h
98index bef20701..b422a587 100644
99--- a/Source/JavaScriptCore/wasm/WasmSections.h
100+++ b/Source/JavaScriptCore/wasm/WasmSections.h
101@@ -33,20 +33,21 @@ IGNORE_RETURN_TYPE_WARNINGS_BEGIN
102
103 namespace JSC { namespace Wasm {
104
105+// macro(Name, ID, OrderingNumber, Description).
106 #define FOR_EACH_KNOWN_WASM_SECTION(macro) \
107- macro(Type, 1, "Function signature declarations") \
108- macro(Import, 2, "Import declarations") \
109- macro(Function, 3, "Function declarations") \
110- macro(Table, 4, "Indirect function table and other tables") \
111- macro(Memory, 5, "Memory attributes") \
112- macro(Global, 6, "Global declarations") \
113- macro(Export, 7, "Exports") \
114- macro(Start, 8, "Start function declaration") \
115- macro(Element, 9, "Elements section") \
116- macro(Code, 10, "Function bodies (code)") \
117- macro(Data, 11, "Data segments") \
118- macro(DataCount, 12, "Data count") \
119- macro(Exception, 13, "Exception declarations") \
120+ macro(Type, 1, 1, "Function signature declarations") \
121+ macro(Import, 2, 2, "Import declarations") \
122+ macro(Function, 3, 3, "Function declarations") \
123+ macro(Table, 4, 4, "Indirect function table and other tables") \
124+ macro(Memory, 5, 5, "Memory attributes") \
125+ macro(Global, 6, 7, "Global declarations") \
126+ macro(Export, 7, 8, "Exports") \
127+ macro(Start, 8, 9, "Start function declaration") \
128+ macro(Element, 9, 10, "Elements section") \
129+ macro(Code, 10, 12, "Function bodies (code)") \
130+ macro(Data, 11, 13, "Data segments") \
131+ macro(DataCount, 12, 11, "Data count") \
132+ macro(Exception, 13, 6, "Exception declarations") \
133
134 enum class Section : uint8_t {
135 // It's important that Begin is less than every other section number and that Custom is greater.
136@@ -54,18 +55,29 @@ enum class Section : uint8_t {
137 // Also, Begin is not a real section but is used as a marker for validating the ordering
138 // of sections.
139 Begin = 0,
140-#define DEFINE_WASM_SECTION_ENUM(NAME, ID, DESCRIPTION) NAME = ID,
141+#define DEFINE_WASM_SECTION_ENUM(NAME, ID, ORDERING, DESCRIPTION) NAME = ID,
142 FOR_EACH_KNOWN_WASM_SECTION(DEFINE_WASM_SECTION_ENUM)
143 #undef DEFINE_WASM_SECTION_ENUM
144 Custom
145 };
146 static_assert(static_cast<uint8_t>(Section::Begin) < static_cast<uint8_t>(Section::Type), "Begin should come before the first known section.");
147
148+inline unsigned orderingNumber(Section section)
149+{
150+ switch (section) {
151+#define ORDERING_OF_SECTION(NAME, ID, ORDERING, DESCRIPTION) case Section::NAME: return ORDERING;
152+ FOR_EACH_KNOWN_WASM_SECTION(ORDERING_OF_SECTION)
153+#undef VALIDATE_SECTION
154+ default:
155+ return static_cast<unsigned>(section);
156+ }
157+}
158+
159 template<typename Int>
160 inline bool isKnownSection(Int section)
161 {
162 switch (section) {
163-#define VALIDATE_SECTION(NAME, ID, DESCRIPTION) case static_cast<Int>(Section::NAME): return true;
164+#define VALIDATE_SECTION(NAME, ID, ORDERING, DESCRIPTION) case static_cast<Int>(Section::NAME): return true;
165 FOR_EACH_KNOWN_WASM_SECTION(VALIDATE_SECTION)
166 #undef VALIDATE_SECTION
167 default:
168@@ -89,13 +101,7 @@ inline bool decodeSection(uint8_t sectionByte, Section& section)
169 inline bool validateOrder(Section previousKnown, Section next)
170 {
171 ASSERT(isKnownSection(previousKnown) || previousKnown == Section::Begin);
172- if (previousKnown == Section::DataCount && next == Section::Code)
173- return true;
174- if (previousKnown == Section::Exception)
175- return next >= Section::Global;
176- if (next == Section::Exception)
177- return previousKnown <= Section::Memory;
178- return static_cast<uint8_t>(previousKnown) < static_cast<uint8_t>(next);
179+ return orderingNumber(previousKnown) < orderingNumber(next);
180 }
181
182 inline const char* makeString(Section section)
183@@ -105,7 +111,7 @@ inline const char* makeString(Section section)
184 return "Begin";
185 case Section::Custom:
186 return "Custom";
187-#define STRINGIFY_SECTION_NAME(NAME, ID, DESCRIPTION) case Section::NAME: return #NAME;
188+#define STRINGIFY_SECTION_NAME(NAME, ID, ORDERING, DESCRIPTION) case Section::NAME: return #NAME;
189 FOR_EACH_KNOWN_WASM_SECTION(STRINGIFY_SECTION_NAME)
190 #undef STRINGIFY_SECTION_NAME
191 }
192diff --git a/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp b/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp
193index fa552eff..25e7e32d 100644
194--- a/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp
195+++ b/Source/JavaScriptCore/wasm/WasmStreamingParser.cpp
196@@ -161,7 +161,7 @@ auto StreamingParser::parseSectionPayload(Vector<uint8_t>&& data) -> State
197 {
198 SectionParser parser(data.data(), data.size(), m_offset, m_info.get());
199 switch (m_section) {
200-#define WASM_SECTION_PARSE(NAME, ID, DESCRIPTION) \
201+#define WASM_SECTION_PARSE(NAME, ID, ORDERING, DESCRIPTION) \
202 case Section::NAME: { \
203 WASM_STREAMING_PARSER_FAIL_IF_HELPER_FAILS(parser.parse ## NAME()); \
204 break; \
205@@ -393,9 +393,18 @@ auto StreamingParser::finalize() -> State
206 m_state = fail("Number of functions parsed (", m_functionCount, ") does not match the number of declared functions (", m_info->functions.size(), ")");
207 break;
208 }
209+
210+ if (m_info->numberOfDataSegments) {
211+ if (UNLIKELY(m_info->data.size() != m_info->numberOfDataSegments.value())) {
212+ m_state = fail("Data section's count ", m_info->data.size(), " is different from Data Count section's count ", m_info->numberOfDataSegments.value());
213+ break;
214+ }
215+ }
216+
217 if (m_remaining.isEmpty()) {
218 if (UNLIKELY(Options::useEagerWebAssemblyModuleHashing()))
219 m_info->nameSection->setHash(m_hasher.computeHexDigest());
220+
221 m_state = State::Finished;
222 m_client.didFinishParsing();
223 } else
224--
2252.40.0
diff --git a/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb b/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb
index 20f475bebd..10fcd0813a 100644
--- a/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb
+++ b/meta/recipes-sato/webkit/webkitgtk_2.36.8.bb
@@ -22,6 +22,7 @@ SRC_URI = "https://www.webkitgtk.org/releases/${BP}.tar.xz \
22 file://CVE-2022-42867.patch \ 22 file://CVE-2022-42867.patch \
23 file://CVE-2022-46700.patch \ 23 file://CVE-2022-46700.patch \
24 file://CVE-2023-23529.patch \ 24 file://CVE-2023-23529.patch \
25 file://CVE-2022-48503.patch \
25 " 26 "
26SRC_URI[sha256sum] = "0ad9fb6bf28308fe3889faf184bd179d13ac1b46835d2136edbab2c133d00437" 27SRC_URI[sha256sum] = "0ad9fb6bf28308fe3889faf184bd179d13ac1b46835d2136edbab2c133d00437"
27 28
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-09 00:53:58 +0000