CVE-2024-23254
Overview
Advisory: Apple Security Advisory
Impact:
Description: A malicious website may exfiltrate audio data cross-origin
Researchers: James Lee (@Windowsrcer)
| Attribute | Value |
|---|---|
| CVE | CVE-2024-23254 |
| Bugzilla | 263795 |
| Component | WebCore |
| Bug Class | CrossOrigin |
| Severity | medium |
| Commit | 26583bfadc4b6606… |
| Advisory | Apple Advisory |
Root Cause Analysis
The issue was addressed with improved UI handling.
Files Changed
Source Files
Source/WebCore/platform/graphics/coretext/FontCustomPlatformDataCoreText.cpp
Test Files
LayoutTests/TestExpectationsLayoutTests/platform/gtk/TestExpectationsLayoutTests/platform/wpe/TestExpectations
Patch Preview
diff --git a/LayoutTests/TestExpectations b/LayoutTests/TestExpectations
index c7a1442ce349..2f79a1e5d51c 100644
--- a/LayoutTests/TestExpectations
+++ b/LayoutTests/TestExpectations
@@ -3711,8 +3711,6 @@ webkit.org/b/219735 imported/w3c/web-platform-tests/css/css-font-loading/fontfac
# @font-face: size-adjust and text-decoration
webkit.org/b/206881 imported/w3c/web-platform-tests/css/css-fonts/size-adjust-text-decoration.tentative.html [ ImageOnlyFailure ]
-# @font-face: size-adjust and optical-size
-webkit.org/b/255862 imported/w3c/web-platform-tests/css/css-fonts/variations/variable-opsz-size-adjust.html [ ImageOnlyFailure ]
# We intentionally do not want to allow disabling required ligatures, so we don't honor this optional test.
imported/w3c/web-platform-tests/css/css-fonts/font-variant-ligatures-11.optional.html [ ImageOnlyFailure ]
diff --git a/LayoutTests/platform/gtk/TestExpectations b/LayoutTests/platform/gtk/TestExpectations
index 6399c3a72d4d..d8915a7e8068 100644
--- a/LayoutTests/platform/gtk/TestExpectations
+++ b/LayoutTests/platform/gtk/TestExpectations
@@ -812,6 +812,9 @@ webkit.org/b/161962 fast/forms/implicit-submission.html [ Failure ]
webkit.org/b/169531 fast/text/font-selection-font-face-parse.html [ Skip ]
+# @font-face: missing integration between size-adjust and optical-size
+ webkit.org/b/256457 imported/w3c/web-platform-tests/css/css-fonts/variations/variable-opsz-size-adjust.html [ ImageOnlyFailure ]
+
# CSS image-orientation is not yet enabled.
webkit.org/b/89052 fast/css/image-orientation [ Skip ]
diff --git a/LayoutTests/platform/wpe/TestExpectations b/LayoutTests/platform/wpe/TestExpectations
index 2d246b5db981..b24120c77621 100644
--- a/LayoutTests/platform/wpe/TestExpectations
+++ b/LayoutTests/platform/wpe/TestExpectations
@@ -771,6 +771,9 @@ webkit.org/b/217370 fast/events/setDragImage-element-non-nullable.html [ Failure
webkit.org/b/256310 imported/w3c/web-platform-tests/css/css-fonts/parsing/font-face-src-tech.html [ Skip ]
+# @font-face: missing integration between size-adjust and optical-size
+ webkit.org/b/256457 imported/w3c/web-platform-tests/css/css-fonts/variations/variable-opsz-size-adjust.html [ ImageOnlyFailure ]
+
# WebXR
webkit.org/b/225483 [ Release ] imported/w3c/web-platform-tests/webxr/events_input_source_recreation.https.html [ Pass ]
webkit.org/b/225483 [ Release ] imported/w3c/web-platform-tests/webxr/events_input_sources_change.https.html [ Pass ]
diff --git a/Source/WebCore/platform/graphics/coretext/FontCustomPlatformDataCoreText.cpp b/Source/WebCore/platform/graphics/coretext/FontCustomPlatformDataCoreText.cpp
index 7fea5f90a5a4..0362bd3efb01 100644
--- a/Source/WebCore/platform/graphics/coretext/FontCustomPlatformDataCoreText.cpp
+++ b/Source/WebCore/platform/graphics/coretext/FontCustomPlatformDataCoreText.cpp
@@ -42,13 +42,13 @@ FontCustomPlatformData::~FontCustomPlatformData() = default;
FontPlatformData FontCustomPlatformData::fontPlatformData(const FontDescription& fontDescription, bool bold, bool italic, const FontCreationContext& fontCreationContext)
{
+ auto size = fontDescription.adjustedSizeForFontFace(fontCreationContext.sizeAdjust());
UnrealizedCoreTextFont unrealizedFont = { RetainPtr { fontDescriptor } };
- unrealizedFont.setSize(fontDescription.computedPixelSize());
+ unrealizedFont.setSize(size);
unrealizedFont.modify([&](CFMutableDictionaryRef attributes) {
addAttributesForWebFonts(attributes, fontDescription.shouldAllowUserInstalledFonts());
});
- auto size = fontDescription.adjustedSizeForFontFace(fontCreationContext.sizeAdjust());
FontOrientation orientation = fontDescription.orientation();
FontWidthVariant widthVariant = fontDescription.widthVariant();