Title: [264074] releases/WebKitGTK/webkit-2.28/Source/WebKit
- Revision
- 264074
- Author
- [email protected]
- Date
- 2020-07-08 03:06:16 -0700 (Wed, 08 Jul 2020)
Log Message
Merge r259037 - Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s) in IPC::Connection::sendOutgoingMessage
https://bugs.webkit.org/show_bug.cgi?id=146729
Patch by Michael Catanzaro <[email protected]> on 2020-03-26
Reviewed by Carlos Garcia Campos.
The entire MessageInfo is passed to write(), so we have to zero the padding bytes to avoid
writing uninitialized memory.
* Platform/IPC/unix/UnixMessage.h:
(IPC::MessageInfo::MessageInfo):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.28/Source/WebKit/ChangeLog (264073 => 264074)
--- releases/WebKitGTK/webkit-2.28/Source/WebKit/ChangeLog 2020-07-08 09:02:39 UTC (rev 264073)
+++ releases/WebKitGTK/webkit-2.28/Source/WebKit/ChangeLog 2020-07-08 10:06:16 UTC (rev 264074)
@@ -1,3 +1,16 @@
+2020-03-26 Michael Catanzaro <[email protected]>
+
+ Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s) in IPC::Connection::sendOutgoingMessage
+ https://bugs.webkit.org/show_bug.cgi?id=146729
+
+ Reviewed by Carlos Garcia Campos.
+
+ The entire MessageInfo is passed to write(), so we have to zero the padding bytes to avoid
+ writing uninitialized memory.
+
+ * Platform/IPC/unix/UnixMessage.h:
+ (IPC::MessageInfo::MessageInfo):
+
2020-06-01 Michael Catanzaro <[email protected]>
[WPE][GTK] pthread_create() fails with EPERM in the second WebKitWebProcess with sandbox on
Modified: releases/WebKitGTK/webkit-2.28/Source/WebKit/Platform/IPC/unix/UnixMessage.h (264073 => 264074)
--- releases/WebKitGTK/webkit-2.28/Source/WebKit/Platform/IPC/unix/UnixMessage.h 2020-07-08 09:02:39 UTC (rev 264073)
+++ releases/WebKitGTK/webkit-2.28/Source/WebKit/Platform/IPC/unix/UnixMessage.h 2020-07-08 10:06:16 UTC (rev 264074)
@@ -34,12 +34,18 @@
class MessageInfo {
public:
- MessageInfo() = default;
+ MessageInfo()
+ {
+ // The entire MessageInfo is passed to write(), so we have to zero our
+ // padding bytes to avoid writing uninitialized memory.
+ memset(this, 0, sizeof(*this));
+ }
MessageInfo(size_t bodySize, size_t initialAttachmentCount)
- : m_bodySize(bodySize)
- , m_attachmentCount(initialAttachmentCount)
{
+ memset(this, 0, sizeof(*this));
+ m_bodySize = bodySize;
+ m_attachmentCount = initialAttachmentCount;
}
void setBodyOutOfLine()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
