Nico Grunbaum
8e56325cbc
Upstream commit: https://webrtc.googlesource.com/src/+/34505048c030ee72ad6ee99f46534861ebb0e365 Cap RTCConfiguration certificates and enforce 32-bit overflow checks 1. Bounded the maximum number of certificates in RTCConfiguration to 1000 to prevent reference counter overflow while maintaining ample headroom for legitimate multi-algorithm DTLS interoperability. 2. Updated webrtc_impl::RefCounter to declare IncRef() out-of-line unconditionally across all architectures. 3. Implemented RefCounter::IncRef() out-of-line in ref_counter.cc with an explicit RTC_CHECK_LT(prev, INT_MAX) guard on all architectures, preventing 32-bit integer overflow and Use-After-Free vulnerabilities unconditionally without causing inlined binary bloat. Bug: chromium:513154132 Fixed: chromium:513154132 Change-Id: I9894ef08519423b24139b0250cc9da0f9737827a Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/472722 Commit-Queue: Tomas Gunnarsson <tommi@webrtc.org> Reviewed-by: Harald Alvestrand <hta@webrtc.org> Cr-Commit-Position: refs/heads/main@{#47722}
50 lines
1.7 KiB
Diff
50 lines
1.7 KiB
Diff
From: Michael Froman <mfroman@mozilla.com>
|
|
Date: Mon, 24 Oct 2022 13:00:00 -0500
|
|
Subject: Bug 1797161 - pt1 - tweak BUILD.gn around task_queue_win usage. r?ng!
|
|
|
|
Add assurance that we will not build task_queue_win.cc to avoid
|
|
possible win32k API usage.
|
|
|
|
Differential Revision: https://phabricator.services.mozilla.com/D160115
|
|
Mercurial Revision: https://hg.mozilla.org/mozilla-central/rev/f097eb8cbd8b7686ce306a46a4db691194fd39c1
|
|
---
|
|
api/task_queue/BUILD.gn | 5 +++++
|
|
rtc_base/BUILD.gn | 4 ++++
|
|
2 files changed, 9 insertions(+)
|
|
|
|
diff --git a/api/task_queue/BUILD.gn b/api/task_queue/BUILD.gn
|
|
index cb35bf1839..dc14e40d7a 100644
|
|
--- a/api/task_queue/BUILD.gn
|
|
+++ b/api/task_queue/BUILD.gn
|
|
@@ -28,6 +28,11 @@ rtc_library("task_queue") {
|
|
]
|
|
}
|
|
|
|
+# Mozilla - we want to ensure that rtc_include_tests is set to false
|
|
+# to guarantee that default_task_queue_factory is not used so we
|
|
+# know that remaining win32k code in task_queue_win.cc is not built.
|
|
+# See Bug 1797161 for more info.
|
|
+assert(!rtc_include_tests, "Mozilla - verify rtc_include_tests is off")
|
|
if (rtc_include_tests) {
|
|
rtc_library("task_queue_test") {
|
|
visibility = [ "*" ]
|
|
diff --git a/rtc_base/BUILD.gn b/rtc_base/BUILD.gn
|
|
index 67b2b4c179..3fd3f9329f 100644
|
|
--- a/rtc_base/BUILD.gn
|
|
+++ b/rtc_base/BUILD.gn
|
|
@@ -777,10 +777,14 @@ if (is_mac || is_ios) {
|
|
if (is_win) {
|
|
rtc_library("rtc_task_queue_win") {
|
|
visibility = [ "../api/task_queue:default_task_queue_factory" ]
|
|
+# See Bug 1797161 for more info. Remove from build until win32k
|
|
+# usage is removed.
|
|
+if (!build_with_mozilla) {
|
|
sources = [
|
|
"task_queue_win.cc",
|
|
"task_queue_win.h",
|
|
]
|
|
+}
|
|
deps = [
|
|
":checks",
|
|
":logging",
|