webkit2gtk3/SOURCES/CVE-2025-24201.patch
2025-03-17 07:36:58 +00:00

55 lines
1.9 KiB
Diff

From 541280709a62351643fa7b456bc1f6d652fd9d0b Mon Sep 17 00:00:00 2001
From: Kimmo Kinnunen <kkinnunen@apple.com>
Date: Wed, 5 Mar 2025 16:49:53 -0800
Subject: [PATCH] Cherry-pick b48791700366. rdar://146337054
WebGL context primitive restart can be toggled from WebContent process
https://bugs.webkit.org/show_bug.cgi?id=285858
rdar://142693598
Reviewed by Cameron McCormack.
Primitive restart is enabled for WebGL2 and disabled for WebGL 1
contexts by default. There is no use-case for toggling it from
WCP. Do not pass enable/disable to ANGLE.
* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:
(WebCore::GraphicsContextGLANGLE::disable):
(WebCore::GraphicsContextGLANGLE::enable):
Canonical link: https://commits.webkit.org/289651.23@safari-7621-branch
---
.../graphics/angle/GraphicsContextGLANGLE.cpp | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp b/Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp
index 39d148172b4f..81c9dff2fb89 100644
--- a/Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp
+++ b/Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp
@@ -1169,7 +1169,11 @@ void GraphicsContextGLANGLE::disable(GCGLenum cap)
{
if (!makeContextCurrent())
return;
-
+ if (cap == PRIMITIVE_RESTART_FIXED_INDEX) {
+ if (m_isForWebGL2)
+ addError(GCGLErrorCode::InvalidOperation);
+ return;
+ }
GL_Disable(cap);
}
@@ -1203,7 +1207,11 @@ void GraphicsContextGLANGLE::enable(GCGLenum cap)
{
if (!makeContextCurrent())
return;
-
+ if (cap == PRIMITIVE_RESTART_FIXED_INDEX) {
+ if (!m_isForWebGL2)
+ addError(GCGLErrorCode::InvalidOperation);
+ return;
+ }
GL_Enable(cap);
}