diff --git a/media/renderers/video_resource_updater.cc b/media/renderers/video_resource_updater.cc index 0000000000..1111111111 100644 --- a/media/renderers/video_resource_updater.cc +++ b/media/renderers/video_resource_updater.cc @@ -853,7 +853,33 @@ void VideoResourceUpdater::ObtainTextureBackedFrameResource( } #if BUILDFLAG(IS_ANDROID) - transfer_resource.ycbcr_info = video_frame->metadata().ycbcr_info; + // --------------------------------------------------------------------------- + // POC: simulate a compromised renderer fabricating VulkanYCbCrInfo on a + // TransferableResource that is shipped to the GPU process via + // viz::mojom::CompositorFrameSink::SubmitCompositorFrame. + // + // The GPU-process compatibility check (DawnYCbCrVkDescriptorsAreCompatible + // in image_context_impl.cc) only compares vkFormat / externalFormat / + // forceExplicitReconstruction, so we copy those from the legitimate driver- + // derived info and overwrite the unchecked fields. + // --------------------------------------------------------------------------- + if (video_frame->metadata().ycbcr_info) { + gpu::VulkanYCbCrInfo evil = *video_frame->metadata().ycbcr_info; + // Lie that the format supports linear chroma filtering. This causes + // ToDawnYCbCrVkDescriptor() to set vkChromaFilter = wgpu::FilterMode::Linear, + // which is forwarded to vkCreateSamplerYcbcrConversion via + // dawn::native::vulkan::CreateSamplerYCbCrConversion without checking + // whether the real format actually advertises + // VK_FORMAT_FEATURE_SAMPLED_IMAGE_YCBCR_CONVERSION_LINEAR_FILTER_BIT. + // -> VUID-VkSamplerYcbcrConversionCreateInfo-chromaFilter-01657 violation. + evil.format_features = 0x40000u; // ..._LINEAR_FILTER_BIT + // The remaining enum fields are now range-checked by mojom traits, so + // keep them in-range. They are still ignored by the compatibility check. + transfer_resource.ycbcr_info = evil; + } else { + transfer_resource.ycbcr_info = video_frame->metadata().ycbcr_info; + } transfer_resource.is_backed_by_surface_view = video_frame->metadata().in_surface_view; #endif