Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 83b7d1094b341c9fef824c58e88fcb5ebcf41141
https://github.com/WebKit/WebKit/commit/83b7d1094b341c9fef824c58e88fcb5ebcf41141
Author: Kimmo Kinnunen <[email protected]>
Date: 2024-06-14 (Fri, 14 Jun 2024)
Changed paths:
M Source/WebKit/Platform/IPC/Connection.h
M Source/WebKit/Platform/IPC/MessageSender.h
M Source/WebKit/Platform/IPC/StreamClientConnection.h
M Source/WebKit/UIProcess/RemotePageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.h
M Tools/TestWebKitAPI/Tests/IPC/ConnectionTests.cpp
M Tools/TestWebKitAPI/Tests/IPC/IPCTestUtilities.h
Log Message:
-----------
REGRESSION(272822@main): IPC sync replies might use freed data
https://bugs.webkit.org/show_bug.cgi?id=275434
rdar://125071066
Reviewed by Cameron McCormack.
The commit 272822@main would remove IPC::Decoder from the
ConnectionSendSyncResult. The decoder owns the data pointed by the
data references. This change results in sender reading freed memory
when reading the reply data references.
Fix by ensuring ConnectionSendSyncResult stores the IPC::Decoder that
owns the data referenced by the reply.
Using data references, e.g. std::spans, in IPC messages means that the
data is stored in the IPC message. Contrast this with messages transferring
Vectors: the Vectors store the data.
* Source/WebKit/Platform/IPC/Connection.h:
(IPC::ConnectionSendSyncResult::ConnectionSendSyncResult):
(IPC::ConnectionSendSyncResult::reply):
(IPC::ConnectionSendSyncResult::takeReply):
(IPC::Connection::sendSync):
* Source/WebKit/Platform/IPC/MessageSender.h:
* Source/WebKit/Platform/IPC/StreamClientConnection.h:
(IPC::StreamClientConnection::trySendSyncStream):
* Source/WebKit/UIProcess/RemotePageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.h:
* Tools/TestWebKitAPI/Tests/IPC/ConnectionTests.cpp:
(TestWebKitAPI::MockTestSyncMessageWithDataReply::name):
(TestWebKitAPI::MockTestSyncMessageWithDataReply::arguments):
(TestWebKitAPI::MockTestSyncMessageWithDataReply::MockTestSyncMessageWithDataReply):
(TestWebKitAPI::TEST_P):
* Tools/TestWebKitAPI/Tests/IPC/IPCTestUtilities.h:
Canonical link: https://commits.webkit.org/280004@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
