Changeset 184005 in webkit

Timestamp:

May 8, 2015, 12:14:43 PM (11 years ago)

Author:

ap@apple.com

Message:

Crashes in SocketStreamHandleBase::close
​https://bugs.webkit.org/show_bug.cgi?id=144767
rdar://problem/20486538

Reviewed by Brady Eidson.

This is a speculative fix, I could not reproduce the crash.

• Modules/websockets/WebSocketChannel.cpp: (WebCore::WebSocketChannel::processFrame):

Normally, processOutgoingFrameQueue() closes the handle in the end when called in
OutgoingFrameQueueClosing state. But there is no definitive protection against
processing two CLOSE frames, in which case we'd try to close the handle twice.

• platform/network/cf/SocketStreamHandleCFNet.cpp:

(WebCore::SocketStreamHandle::readStreamCallback): Passing empty data to the client
results in the socket being closed, which makes no sense here.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/websockets/WebSocketChannel.cpp (modified) (1 diff)
• platform/network/cf/SocketStreamHandleCFNet.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-05-08  Alexey Proskuryakov  <ap@apple.com>
+
+        Crashes in SocketStreamHandleBase::close
+        https://bugs.webkit.org/show_bug.cgi?id=144767
+        rdar://problem/20486538
+
+        Reviewed by Brady Eidson.
+
+        This is a speculative fix, I could not reproduce the crash.
+
+        * Modules/websockets/WebSocketChannel.cpp: (WebCore::WebSocketChannel::processFrame):
+        Normally, processOutgoingFrameQueue() closes the handle in the end when called in
+        OutgoingFrameQueueClosing state. But there is no definitive protection against
+        processing two CLOSE frames, in which case we'd try to close the handle twice.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): Passing empty data to the client
+        results in the socket being closed, which makes no sense here.
+
 2015-05-08  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/Modules/websockets/WebSocketChannel.cpp

@@ -650 +650 @@
         startClosingHandshake(m_closeEventCode, m_closeEventReason);
         if (m_closing) {
-            m_outgoingFrameQueueStatus = OutgoingFrameQueueClosing;
+            if (m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen)
+                m_outgoingFrameQueueStatus = OutgoingFrameQueueClosing;
             processOutgoingFrameQueue();
         }

trunk/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp

@@ -508 +508 @@
         }
 
+        if (!length)
+            return;
+
         m_client->didReceiveSocketStreamData(this, reinterpret_cast<const char*>(ptr), length);