← WebKit — 2026-W37
e410d5cb1d2c66ceda33ef1d450fc804ecf4776f Heap Buffer Overflow in WebRTC VP9 Encoder
severity medium
class InputValidation
confidence 0.55
signal score 6.3
Source/WebCore/Modules
Primitive: WebCodecs video encoder config accepted width/height beyond 32767 (potential integer-overflow/OOB in codec backend)
Triage note: isSupportedEncoderCodec now rejects config.width/height > 32767 (INT16_MAX) before accepting an encoder configuration in configure()/isConfigSupported(). Adds an attacker-reachable dimension cap plausibly guarding a codec-side integer/size overflow, but the downstream bug is not shown in this diff so confidence as a genuine security fix is moderate.
Triage note: isSupportedEncoderCodec now rejects config.width/height > 32767 (INT16_MAX) before accepting an encoder configuration in configure()/isConfigSupported(). Adds an attacker-reachable dimension cap plausibly guarding a codec-side integer/size overflow, but the downstream bug is not shown in this diff so confidence as a genuine security fix is moderate.
Structural signals: msg_strong (+3.0), msg_medium (+2.0), surgical (+1.3)
Commit message
Heap Buffer Overflow in WebRTC VP9 Encoder
rdar://177719944
Reviewed by Jean-Yves Avenard.
We restrict video encoder support to frames of size below 32767.
This aligns with Chrome so should not be a compat issue.
Test: http/wpt/webcodecs/configure-encoder-big-frame-size.html
* LayoutTests/http/wpt/webcodecs/configure-encoder-big-frame-size-expected.txt: Added.
* LayoutTests/http/wpt/webcodecs/configure-encoder-big-frame-size.html: Added.
* Source/WebCore/Modules/webcodecs/WebCodecsVideoEncoder.cpp:
(WebCore::isSupportedEncoderCodec):
(WebCore::WebCodecsVideoEncoder::configure):
(WebCore::WebCodecsVideoEncoder::isConfigSupported):
Originally-landed-as: 305413.884@safari-7624.4-branch (b8eb06fa26e8). rdar://184744397
Canonical link: https://commits.webkit.org/320737@main
Before / after
Loading diff…
On This Page