← WebKit — 2026-W35
037843ae12ffcf5071691e3a0ded328179b37a6e Validate fingerprints to previous generated offer/answer when apply a local description
severity medium
class InputValidation
confidence 0.5
signal score 8.07
Source/WebCore/Modules/mediastream
Primitive: setLocalDescription accepted an SDP whose DTLS a=fingerprint differed from the last created offer/answer
Triage note: Adds isSdpFingerprintValid() plus m_isLastCreatedOffer/AnswerFresh tracking and rejects a local description with InvalidModificationError when its fingerprint line does not match the cached offer/answer. This is a genuine WebRTC validation hardening against fingerprint substitution, but it is logic/policy, not a memory-safety bug.
Triage note: Adds isSdpFingerprintValid() plus m_isLastCreatedOffer/AnswerFresh tracking and rejects a local description with InvalidModificationError when its fingerprint line does not match the cached offer/answer. This is a genuine WebRTC validation hardening against fingerprint substitution, but it is logic/policy, not a memory-safety bug.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.2), msg_soft (+1.0), msg_feature (-1.0), area:Source/WebCore/Modules/mediastream (+2.0)
Commit message
Validate fingerprints to previous generated offer/answer when apply a local description
rdar://183719203
https://bugs.webkit.org/show_bug.cgi?id=320733
Reviewed by Eric Carlson.
We update setLocalDescription for the non parameter less setLocalDescription.
To validate that applied description comes from the previous generated offer/answer, we validate the fingerprints.
We do not go as far as validating the whole SDP since SDP munging is still a thing.
We also stop resetting last offer/answer in RTCPeerConnection::updateDescriptions as this is not as per spec.
To not change the parameterless setLocalDescription behavior, we introduce booleans to control how much we reuse the last offer/answer.
Covered by rebased tests.
* LayoutTests/imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-answer-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-offer_interop-2026-expected.txt:
* Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::createOffer):
(WebCore::RTCPeerConnection::createAnswer):
(WebCore::typeForSetLocalDescription):
(WebCore::isSdpFingerprintValid):
(WebCore::RTCPeerConnection::setLocalDescription):
(WebCore::RTCPeerConnection::updateDescriptions):
* Source/WebCore/Modules/mediastream/RTCPeerConnection.h:
Canonical link: https://commits.webkit.org/319822@main
Before / after
Loading diff…
On This Page