Timing attack on SVG feComposite filter circumvents same-origin policy
https://bugs.webkit.org/show_bug.cgi?id=154338
Patch by Said Abou-Hallawa <sabouhallawa@apple,com> on 2016-04-08
Reviewed by Oliver Hunt.
Ensure the FEComposite arithmetic filter is clamping the resulted color
components in a constant time.
* platform/graphics/filters/FEComposite.cpp:
(WebCore::clampByte):
(WebCore::computeArithmeticPixels):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@199243 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 7c71517..7c3e008 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2016-04-08 Said Abou-Hallawa <sabouhallawa@apple,com>
+
+ Timing attack on SVG feComposite filter circumvents same-origin policy
+ https://bugs.webkit.org/show_bug.cgi?id=154338
+
+ Reviewed by Oliver Hunt.
+
+ Ensure the FEComposite arithmetic filter is clamping the resulted color
+ components in a constant time.
+
+ * platform/graphics/filters/FEComposite.cpp:
+ (WebCore::clampByte):
+ (WebCore::computeArithmeticPixels):
+
2016-04-08 Brian Burg <bburg@apple.com>
Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index bab97e9..94d1628 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -120,6 +120,13 @@
forceValidPreMultipliedPixels();
}
+
+static unsigned char clampByte(int c)
+{
+ unsigned char buff[] = { static_cast<unsigned char>(c), 255, 0 };
+ unsigned uc = static_cast<unsigned>(c);
+ return buff[!!(uc & ~0xff) + !!(uc & ~(~0u >> 1))];
+}
template <int b1, int b4>
static inline void computeArithmeticPixels(unsigned char* source, unsigned char* destination, int pixelArrayLength,
@@ -141,12 +148,7 @@
if (b4)
result += scaledK4;
- if (result <= 0)
- *destination = 0;
- else if (result >= 255)
- *destination = 255;
- else
- *destination = result;
+ *destination = clampByte(result);
++source;
++destination;
}
