Title: [236523] trunk/Source/WebKit
- Revision
- 236523
- Author
- [email protected]
- Date
- 2018-09-26 14:48:04 -0700 (Wed, 26 Sep 2018)
Log Message
Fix UAF after r236463
https://bugs.webkit.org/show_bug.cgi?id=190011
Reviewed by Chris Dumez.
I had removed an early return in NetworkResourceLoader::continueDidReceiveResponse.
Reading the (probably) null m_responseCompletionHandler was reading after the object had been destroyed.
* NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::continueDidReceiveResponse):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (236522 => 236523)
--- trunk/Source/WebKit/ChangeLog 2018-09-26 20:33:00 UTC (rev 236522)
+++ trunk/Source/WebKit/ChangeLog 2018-09-26 21:48:04 UTC (rev 236523)
@@ -1,3 +1,16 @@
+2018-09-26 Alex Christensen <[email protected]>
+
+ Fix UAF after r236463
+ https://bugs.webkit.org/show_bug.cgi?id=190011
+
+ Reviewed by Chris Dumez.
+
+ I had removed an early return in NetworkResourceLoader::continueDidReceiveResponse.
+ Reading the (probably) null m_responseCompletionHandler was reading after the object had been destroyed.
+
+ * NetworkProcess/NetworkResourceLoader.cpp:
+ (WebKit::NetworkResourceLoader::continueDidReceiveResponse):
+
2018-09-26 Ryosuke Niwa <[email protected]>
Selection should work across shadow boundary when initiated by a mouse drag
Modified: trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp (236522 => 236523)
--- trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp 2018-09-26 20:33:00 UTC (rev 236522)
+++ trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp 2018-09-26 21:48:04 UTC (rev 236523)
@@ -712,8 +712,10 @@
void NetworkResourceLoader::continueDidReceiveResponse()
{
- if (m_cacheEntryWaitingForContinueDidReceiveResponse)
+ if (m_cacheEntryWaitingForContinueDidReceiveResponse) {
continueProcessingCachedEntryAfterDidReceiveResponse(WTFMove(m_cacheEntryWaitingForContinueDidReceiveResponse));
+ return;
+ }
if (m_responseCompletionHandler)
m_responseCompletionHandler(PolicyAction::Use);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
