Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6d6ea48e7ecfbfa18bfc0ae082227fbae7198d57
https://github.com/WebKit/WebKit/commit/6d6ea48e7ecfbfa18bfc0ae082227fbae7198d57
Author: Kiara Rose <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M
Source/WebKit/Shared/Extensions/WebExtensionRegisteredScriptsSQLiteStore.cpp
M Source/WebKit/Shared/Extensions/WebExtensionRegisteredScriptsSQLiteStore.h
M
Source/WebKit/UIProcess/Extensions/WebExtensionDeclarativeNetRequestSQLiteStore.cpp
M
Source/WebKit/UIProcess/Extensions/WebExtensionDeclarativeNetRequestSQLiteStore.h
Log Message:
-----------
heap-use-after-free in WebExtensionRegisteredScriptsSQLiteStore::addScripts
https://bugs.webkit.org/show_bug.cgi?id=312319
rdar://174530074
Reviewed by Timothy Hatcher.
WebExtensionRegisteredScriptsSQLiteStore::addScripts and
WebExtensionDeclarativeNetRequestSQLiteStore::addRules
both captured Ref<JSON::Value> into lambdas dispatched to a background
WorkQueue, while the main
thread still held live references to the same objects. Concurrent increments
and decrements from the
two threads cause a lost update on the m_refCount. When the object is freed
prematurely on the main
thread, the WorkQueue is left holding with a dangling reference, causing a
heap-use-after-free on
the WorkQueue.
Fix this by serializing the data before dispatching it to the WorkQueue.
* Source/WebKit/Shared/Extensions/WebExtensionRegisteredScriptsSQLiteStore.cpp:
(WebKit::WebExtensionRegisteredScriptsSQLiteStore::addScripts):
(WebKit::WebExtensionRegisteredScriptsSQLiteStore::insertScript):
* Source/WebKit/Shared/Extensions/WebExtensionRegisteredScriptsSQLiteStore.h:
*
Source/WebKit/UIProcess/Extensions/WebExtensionDeclarativeNetRequestSQLiteStore.cpp:
(WebKit::WebExtensionDeclarativeNetRequestSQLiteStore::addRules):
(WebKit::WebExtensionDeclarativeNetRequestSQLiteStore::insertRule):
*
Source/WebKit/UIProcess/Extensions/WebExtensionDeclarativeNetRequestSQLiteStore.h:
Originally-landed-as: 305413.675@safari-7624-branch (c85584f296ce).
rdar://180438305
Canonical link: https://commits.webkit.org/316283@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
