[4] ShareableBitmap IPC validator integer overflow

Severity: High | Component: WebKit IPC serialization | 3d2be34

Rated High because the observable effect is an IPC validation bypass reachable from a compromised renderer, and the projected escalation (inconsistent bitmap parameters reaching a privileged process for OOB memory access) follows directly from the arithmetic overflow at confidence 0.88 — unverified claims concern the exact signed/unsigned promotion behavior and whether specific downstream processes are impacted.

The IPC validator for ShareableBitmap::bytesPerRow() used a raw multiplication m_size->width() * *bytesPerPixel that could overflow, bypassing the size-consistency check. The fix replaces the raw multiplication with WTF::safeMultiply, which returns false on overflow.

Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in

Patch Details

The patch replaces a one-line inline validator expression with a lambda that first computes the width * bytesPerPixel product via WTF::safeMultiply into a local variable bytesForWidth. If the multiplication overflows, safeMultiply returns false and the validator rejects the IPC message. Only if the multiplication succeeds does the comparison *bytesPerRow >= bytesForWidth proceed. The result type of bytesForWidth is deduced as std::remove_cvref_t<decltype(*bytesPerRow)> — matching the type of bytesPerRow — ensuring the overflow check is performed in the correct arithmetic domain.

Background

WebKit's .serialization.in DSL generates C++ argument coders for IPC messages. Each serialized field can have a [Validator=...] attribute — a C++ expression that must evaluate to true for deserialization to succeed. These validators run in the receiving process and are the primary defense against malformed IPC payloads from compromised senders.

ShareableBitmap is a WebKit type for sharing bitmap image data across process boundaries via shared memory. Its serialized form includes dimensions (m_size), bytesPerPixel, bytesPerRow, and pixel format metadata. The receiving process uses these parameters to compute buffer sizes and offsets when mapping the shared memory region.

WTF::safeMultiply is a WebKit utility that performs multiplication and returns false if the result would overflow the destination type, rather than silently wrapping. It is already used in several other size-computation sites (SharedVideoFrameInfo, CVUtilities, WebAudioBufferList), suggesting awareness of this pattern — but the ShareableBitmap validator was missed.

Analysis

Unsigned/signed arithmetic overflow in an IPC input validator bypassing a size-consistency check.

Before the fix, the validator computed m_size->width() * *bytesPerPixel using native arithmetic. The commit message states the multiplication "could overflow into a negative number", indicating the product was computed in a signed type (though C++ promotion rules for mixed signed/unsigned operands may vary — the practical effect is the same either way). When the width is very large, the multiplication wraps. A wrapped result — whether it becomes a small positive unsigned value or a negative signed value — would satisfy the >= comparison against a normal-looking bytesPerRow, causing the validator to accept an inconsistent bitmap configuration.

Audit directions