Title: [280831] releases/WebKitGTK/webkit-2.32/Source/WebKit
- Revision
- 280831
- Author
- [email protected]
- Date
- 2021-08-10 02:22:45 -0700 (Tue, 10 Aug 2021)
Log Message
Merge r274027 - [IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
https://bugs.webkit.org/show_bug.cgi?id=222842
<rdar://problem/75119560>
Reviewed by Darin Adler.
* UIProcess/WebNavigationState.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didDestroyNavigation):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog (280830 => 280831)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:20:44 UTC (rev 280830)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:22:45 UTC (rev 280831)
@@ -1,3 +1,15 @@
+2021-03-05 Chris Dumez <[email protected]>
+
+ [IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
+ https://bugs.webkit.org/show_bug.cgi?id=222842
+ <rdar://problem/75119560>
+
+ Reviewed by Darin Adler.
+
+ * UIProcess/WebNavigationState.h:
+ * UIProcess/WebPageProxy.cpp:
+ (WebKit::WebPageProxy::didDestroyNavigation):
+
2021-07-23 Adrian Perez de Castro <[email protected]>
Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.32.3 release
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebNavigationState.h (280830 => 280831)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebNavigationState.h 2021-08-10 09:20:44 UTC (rev 280830)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebNavigationState.h 2021-08-10 09:22:45 UTC (rev 280831)
@@ -67,8 +67,10 @@
return ++m_navigationID;
}
+ using NavigationMap = HashMap<uint64_t, RefPtr<API::Navigation>>;
+
private:
- HashMap<uint64_t, RefPtr<API::Navigation>> m_navigations;
+ NavigationMap m_navigations;
uint64_t m_navigationID { 0 };
};
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebPageProxy.cpp (280830 => 280831)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebPageProxy.cpp 2021-08-10 09:20:44 UTC (rev 280830)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebPageProxy.cpp 2021-08-10 09:22:45 UTC (rev 280831)
@@ -4382,6 +4382,8 @@
void WebPageProxy::didDestroyNavigation(uint64_t navigationID)
{
+ MESSAGE_CHECK(m_process, WebNavigationState::NavigationMap::isValidKey(navigationID));
+
PageClientProtector protector(pageClient());
// On process-swap, the previous process tries to destroy the navigation but the provisional process is actually taking over the navigation.
@@ -4388,7 +4390,6 @@
if (m_provisionalPage && m_provisionalPage->navigationID() == navigationID)
return;
- // FIXME: Message check the navigationID.
m_navigationState->didDestroyNavigation(navigationID);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
