Changeset 236523 in webkit

Timestamp:

Sep 26, 2018, 2:48:04 PM (8 years ago)

Author:

achristensen@apple.com

Message:

Fix UAF after r236463
​https://bugs.webkit.org/show_bug.cgi?id=190011

Reviewed by Chris Dumez.

I had removed an early return in NetworkResourceLoader::continueDidReceiveResponse.
Reading the (probably) null m_responseCompletionHandler was reading after the object had been destroyed.

• NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::continueDidReceiveResponse):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/NetworkResourceLoader.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-09-26  Alex Christensen  <achristensen@webkit.org>
+
+        Fix UAF after r236463
+        https://bugs.webkit.org/show_bug.cgi?id=190011
+
+        Reviewed by Chris Dumez.
+
+        I had removed an early return in NetworkResourceLoader::continueDidReceiveResponse.
+        Reading the (probably) null m_responseCompletionHandler was reading after the object had been destroyed.
+
+        * NetworkProcess/NetworkResourceLoader.cpp:
+        (WebKit::NetworkResourceLoader::continueDidReceiveResponse):
+
 2018-09-26  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp

@@ -713 +713 @@
 void NetworkResourceLoader::continueDidReceiveResponse()
 {
-    if (m_cacheEntryWaitingForContinueDidReceiveResponse)
+    if (m_cacheEntryWaitingForContinueDidReceiveResponse) {
         continueProcessingCachedEntryAfterDidReceiveResponse(WTFMove(m_cacheEntryWaitingForContinueDidReceiveResponse));
+        return;
+    }
 
     if (m_responseCompletionHandler)