Validate identifiers when creating decoders and encoders in LibWebRTCCodecsProxy

Component: WebKit GPU Process WebRTC | 2feb5ed

Source/WebKit/GPUProcess/webrtc/LibWebRTCCodecsProxy.mm

 void LibWebRTCCodecsProxy::createDecoder(...)
 {
     assertIsCurrent(workQueue());
+
+    MESSAGE_CHECK_COMPLETION(!m_decoders.contains(identifier), callback(false));
+
     if (!codecString.isNull() && !validateCodecString(codecType, codecString)) {
         callback(false);
         return;
     }
     ...
 
 void LibWebRTCCodecsProxy::createEncoder(...)
 {
     assertIsCurrent(workQueue());
+
+    MESSAGE_CHECK_COMPLETION(!m_encoders.contains(identifier), callback(false));
+
     std::map<std::string, std::string> rtcParameters;
     ...

LibWebRTCCodecsProxy runs in the GPU process and manages hardware-backed WebRTC video decoders and encoders on behalf of the less-trusted WebProcess, keyed by identifiers the WebProcess itself chooses. WebKit's IPC security model therefore requires the receiver to validate that untrusted input is well-formed before acting on it, and MESSAGE_CHECK is the standard mechanism — terminating the connection, or bailing out via a completion handler, when an invariant a compromised sender could violate is detected. This patch adds exactly that guard: a createDecoder/createEncoder message reusing an already-active identifier now closes the callback with failure instead of proceeding into codec creation and overwriting the existing map entry.

Significance

A compromised WebProcess can no longer re-register an existing codec identifier in the GPU process and clobber the per-identifier state tracked in the proxy's maps.

Audit directions

Forward-facing, the hunt is for the same duplicate-identifier gap on other identifier-keyed entry points. Narrow: audit this proxy's release and destroy paths, and the analogous audio codec proxies, for create-style handlers that insert into a map without first checking for an existing key — the code-review tell is a m_map.add(identifier, ...) or m_map.set(...) in a message handler with no preceding MESSAGE_CHECK on contains(identifier). Wider: any GPU-process or Networking-process object registry keyed by a renderer-chosen identifier has this shape; enumerate the ObjectIdentifier-keyed maps reachable from IPC handlers and check each creation path. It is also worth establishing what actually happened pre-patch on overwrite — use-after-free, dangling completion handler, or a plain resource leak in the overwritten entry — since that determines how urgent the same gap is elsewhere.