Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: e900d418ada5e9517c34b98b8cf9bee9359ce5b3
https://github.com/WebKit/WebKit/commit/e900d418ada5e9517c34b98b8cf9bee9359ce5b3
Author: Ryosuke Niwa <rn...@webkit.org>
Date: 2025-08-28 (Thu, 28 Aug 2025)
Changed paths:
M Source/WebCore/Modules/encryptedmedia/NavigatorEME.cpp
M
Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations
Log Message:
-----------
Cherry-pick 298534@main (882406de5528).
https://bugs.webkit.org/show_bug.cgi?id=292304
Use-after-free of Document in MediaKeySystemAccess::MediaKeySystemAccess
via tryNextSupportedConfiguration
https://bugs.webkit.org/show_bug.cgi?id=292304
rdar://145888476
Reviewed by Eric Carlson and Brent Fulgham.
tryNextSupportedConfiguration should store Document in WeakPtr instead of a
raw reference to avoid accessing a dead document.
* Source/WebCore/Modules/encryptedmedia/NavigatorEME.cpp:
(WebCore::tryNextSupportedConfiguration):
*
Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:
Originally-landed-as: 289651.470@safari-7621-branch (6d042697c796).
rdar://157794831
Canonical link: https://commits.webkit.org/298534@main
Canonical link: https://commits.webkit.org/298234.68@webkitglib/2.50
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
