Title: [95497] trunk/Source/WebCore
- Revision
- 95497
- Author
- [email protected]
- Date
- 2011-09-19 17:19:02 -0700 (Mon, 19 Sep 2011)
Log Message
Fix a use-after-free: clear the fullscreen change event target queue at
detach time, rather than at destruction time. If this isn't done, it's
possible for the event target queue to be the only thing that
references the document. Then when the document is popped off the queue
and dereferenced in Document::fullScreenChangeDelayTimerFired, the
document is destroyed and the subsequent access to
m_fullScreenChangeEventTargetQueue.isEmpty() accesses free'd memory.
https://bugs.webkit.org/show_bug.cgi?id=67960
Patch by Jeremy Apthorp <[email protected]> on 2011-09-19
Reviewed by Adam Barth.
* dom/Document.cpp:
(WebCore::Document::~Document):
(WebCore::Document::detach):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (95496 => 95497)
--- trunk/Source/WebCore/ChangeLog 2011-09-19 23:50:15 UTC (rev 95496)
+++ trunk/Source/WebCore/ChangeLog 2011-09-20 00:19:02 UTC (rev 95497)
@@ -1,3 +1,20 @@
+2011-09-19 Jeremy Apthorp <[email protected]>
+
+ Fix a use-after-free: clear the fullscreen change event target queue at
+ detach time, rather than at destruction time. If this isn't done, it's
+ possible for the event target queue to be the only thing that
+ references the document. Then when the document is popped off the queue
+ and dereferenced in Document::fullScreenChangeDelayTimerFired, the
+ document is destroyed and the subsequent access to
+ m_fullScreenChangeEventTargetQueue.isEmpty() accesses free'd memory.
+ https://bugs.webkit.org/show_bug.cgi?id=67960
+
+ Reviewed by Adam Barth.
+
+ * dom/Document.cpp:
+ (WebCore::Document::~Document):
+ (WebCore::Document::detach):
+
2011-09-19 Sheriff Bot <[email protected]>
Unreviewed, rolling out r95482.
Modified: trunk/Source/WebCore/dom/Document.cpp (95496 => 95497)
--- trunk/Source/WebCore/dom/Document.cpp 2011-09-19 23:50:15 UTC (rev 95496)
+++ trunk/Source/WebCore/dom/Document.cpp 2011-09-20 00:19:02 UTC (rev 95497)
@@ -574,10 +574,6 @@
(*m_userSheets)[i]->clearOwnerNode();
}
-#if ENABLE(FULLSCREEN_API)
- m_fullScreenChangeEventTargetQueue.clear();
-#endif
-
deleteRetiredCustomFonts();
m_weakReference->clear();
@@ -1828,6 +1824,9 @@
clearAXObjectCache();
stopActiveDOMObjects();
m_eventQueue->close();
+#if ENABLE(FULLSCREEN_API)
+ m_fullScreenChangeEventTargetQueue.clear();
+#endif
#if ENABLE(REQUEST_ANIMATION_FRAME)
// FIXME: consider using ActiveDOMObject.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
