Changeset 262242 in webkit

Timestamp:

May 28, 2020, 8:28:26 AM (6 years ago)

Author:

commit-queue@webkit.org

Message:

[WPE][GTK] GVariant decoding must copy the serialized data
​https://bugs.webkit.org/show_bug.cgi?id=212441

Patch by Michael Catanzaro <Michael Catanzaro> on 2020-05-28
Reviewed by Carlos Garcia Campos.

I tracked this down to ArgumentCodersGLib.cpp. The problem is that we construct a GVariant
using g_variant_new_from_data(), which does not copy or take ownership of the data, so here
we accidentally create the GVariant using data we don't own. (Here, the data is owned by the
Decoder itself in its internal m_buffer.) Anyway, this is fixable by manually copying and
freeing it with the GDestroyNotify parameter, but it's easier to switch to
g_variant_new_from_bytes() because GBytes takes ownership when constructed.

• Shared/glib/ArgumentCodersGLib.cpp:

(IPC::decode):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/glib/ArgumentCodersGLib.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-05-28  Michael Catanzaro  <mcatanzaro@gnome.org>
+
+        [WPE][GTK] GVariant decoding must copy the serialized data
+        https://bugs.webkit.org/show_bug.cgi?id=212441
+
+        Reviewed by Carlos Garcia Campos.
+
+        I tracked this down to ArgumentCodersGLib.cpp. The problem is that we construct a GVariant
+        using g_variant_new_from_data(), which does not copy or take ownership of the data, so here
+        we accidentally create the GVariant using data we don't own. (Here, the data is owned by the
+        Decoder itself in its internal m_buffer.) Anyway, this is fixable by manually copying and
+        freeing it with the GDestroyNotify parameter, but it's easier to switch to
+        g_variant_new_from_bytes() because GBytes takes ownership when constructed.
+
+        * Shared/glib/ArgumentCodersGLib.cpp:
+        (IPC::decode):
+
 2020-05-28  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebKit/Shared/glib/ArgumentCodersGLib.cpp

@@ -29 +29 @@
 #include "DataReference.h"
 #include <glib.h>
+#include <wtf/glib/GUniquePtr.h>
 #include <wtf/text/CString.h>
 
@@ -60 +61 @@
         return WTF::nullopt;
 
-    auto* variantType = g_variant_type_new(variantTypeString.data());
-    GRefPtr<GVariant> variant = g_variant_new_from_data(variantType, data.data(), data.size(), FALSE, nullptr, nullptr);
-    g_variant_type_free(variantType);
-    return variant;
+    GUniquePtr<GVariantType> variantType(g_variant_type_new(variantTypeString.data()));
+    GRefPtr<GBytes> bytes = adoptGRef(g_bytes_new(data.data(), data.size()));
+    return g_variant_new_from_bytes(variantType.get(), bytes.get(), FALSE);
 }