Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ee722e07de6f38964e138a6cc80e484f26c10238
https://github.com/WebKit/WebKit/commit/ee722e07de6f38964e138a6cc80e484f26c10238
Author: Chris Dumez <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WTF/wtf/cocoa/Entitlements.mm
M Source/WebKit/Shared/cf/CoreIPCSecTrust.mm
M Source/WebKit/Shared/mac/ScrollingAccelerationCurveMac.mm
M Tools/Scripts/webkitpy/style/checkers/cpp.py
M Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
Log Message:
-----------
hasEntitlementValueInArray() may leak value returned by
SecTaskCopyValueForEntitlement()
https://bugs.webkit.org/show_bug.cgi?id=319224
Reviewed by David Kilzer.
hasEntitlementValueInArray() may leak value returned by
SecTaskCopyValueForEntitlement() if its type is not CFArrayRef, since
`dynamic_cf_cast<CFArrayRef>()` would return nullptr in this case,
rendering the `adoptCF()` useless.
Fix the issue by adopting the value returned by
SecTaskCopyValueForEntitlement() *before* passing it to
dynamic_cf_cast<>(), so that the RetainPtr<>&& overload of
dynamic_cf_cast<>() releases the value on type mismatch instead of the
`adoptCF()` silently dropping a nullptr.
Also fixed the same bug pattern in other parts of the codebase, where a
value returned by a CF "Copy" function (SecTrustCopyPropertyListRepresentation()
and IOHIDServiceClientCopyProperty()) was wrapped as
adoptCF(dynamic_cf_cast<>(...)) and would leak on type mismatch.
* Source/WTF/wtf/cocoa/Entitlements.mm:
(WTF::hasEntitlementValueInArray):
* Source/WebKit/Shared/cf/CoreIPCSecTrust.mm:
(WebKit::CoreIPCSecTrust::CoreIPCSecTrust):
* Source/WebKit/Shared/mac/ScrollingAccelerationCurveMac.mm:
(WebKit::fromIOHIDDevice):
* Tools/Scripts/webkitpy/style/checkers/cpp.py:
(check_adopt_of_dynamic_cast):
(check_style):
(CppChecker):
* Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py:
(WebKitStyleTest.test_adopt_of_dynamic_cast):
Canonical link: https://commits.webkit.org/317102@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
