← WebKit — 2026-W36
ec56e39bc26fdddc5406e4075aafe8f1abc47ca1 AV1 Packetizer Heap OOB Read via Signed Loop-Condition Overflow
severity medium
class IntegerOverflow
confidence 0.65
signal score 8.3
Source/ThirdParty/libwebrtc
patch-now
Primitive: AV1 OBU size/offset arithmetic could overflow int, mis-sizing fragments during RTP packetization.
Triage note: The non-RC_REMOVE_SEC_ACCEL_3 fix in rtp_packetizer_av1 tightens the OBU overflow check to account for the leb128 size (obu.size > kMaxObuEncodedSize || payload.size() > kMaxObuEncodedSize - obu.size) and rewrites the PacketizeInternal loop bound to obu.size >= max_payload_len && obu_offset < obu.size - max_payload_len, avoiding the signed-overflow-prone obu_offset + max_payload_len < obu.size. Reachable via WebRTC encoded AV1 video.
Triage note: The non-RC_REMOVE_SEC_ACCEL_3 fix in rtp_packetizer_av1 tightens the OBU overflow check to account for the leb128 size (obu.size > kMaxObuEncodedSize || payload.size() > kMaxObuEncodedSize - obu.size) and rewrites the PacketizeInternal loop bound to obu.size >= max_payload_len && obu_offset < obu.size - max_payload_len, avoiding the signed-overflow-prone obu_offset + max_payload_len < obu.size. Reachable via WebRTC encoded AV1 video.
Structural signals: bounds_guard (+2.0), msg_strong (+3.0), msg_medium (+2.0), surgical (+1.3)
Commit message
AV1 Packetizer Heap OOB Read via Signed Loop-Condition Overflow
https://bugs.webkit.org/show_bug.cgi?id=323079
rdar://180163471
Reviewed by Jean-Yves Avenard.
RtpPacketizerAv1::PacketizeInternal fragments large OBUs with the loop condition `obu_offset + limits.max_payload_len < obu.size`.
This addition can overflow if obu.size is above INT_MAX - max_payload_len. We therefore add a check to cover this.
In addition to that, parseObus now rejects any OBU whose payload would push obu.size past INT_MAX - 5, as 5 is the max size used to encode the OBU length in PacketizeInternal.
We only enable the test for sar3 as it may crash otherwise.
We do the same for the previous VP8 fix (+http/wpt/webrtc/script-transform-oversized-frame.html).
Tests: http/wpt/webrtc/av1-packetizer-large-encoded-frame-no-crash.html.
* LayoutTests/http/wpt/webrtc/av1-packetizer-large-obu-overflow-worker.js: Added.
(onrtctransform.process):
(onrtctransform):
* Source/ThirdParty/libwebrtc/Source/webrtc/modules/rtp_rtcp/source/rtp_packetizer_av1.cc:
* LayoutTests/http/wpt/webrtc/av1-packetizer-large-encoded-frame-no-crash-expected.txt: Added.
* LayoutTests/http/wpt/webrtc/av1-packetizer-large-encoded-frame-no-crash.html: Added.
* LayoutTests/TestExpectations:
* LayoutTests/sar3/TestExpectations:
Identifier: 316606.625@safari-7625-branch
Before / after
Loading diff…
On This Page