Changeset 274027 in webkit

Timestamp:

Mar 5, 2021, 6:56:21 PM (5 years ago)

Author:

Chris Dumez

Message:

[IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
​https://bugs.webkit.org/show_bug.cgi?id=222842
<rdar://problem/75119560>

Reviewed by Darin Adler.

• UIProcess/WebNavigationState.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didDestroyNavigation):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebNavigationState.h (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-05  Chris Dumez  <cdumez@apple.com>
+
+        [IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
+        https://bugs.webkit.org/show_bug.cgi?id=222842
+        <rdar://problem/75119560>
+
+        Reviewed by Darin Adler.
+
+        * UIProcess/WebNavigationState.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didDestroyNavigation):
+
 2021-03-05  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/UIProcess/WebNavigationState.h

@@ -68 +68 @@
     }
 
+    using NavigationMap = HashMap<uint64_t, RefPtr<API::Navigation>>;
+
 private:
-    HashMap<uint64_t, RefPtr<API::Navigation>> m_navigations;
+    NavigationMap m_navigations;
     uint64_t m_navigationID { 0 };
 };

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -4376 +4376 @@
 void WebPageProxy::didDestroyNavigation(uint64_t navigationID)
 {
+    MESSAGE_CHECK(m_process, WebNavigationState::NavigationMap::isValidKey(navigationID));
+
     PageClientProtector protector(pageClient());
 
@@ -4382 +4384 @@
         return;
 
-    // FIXME: Message check the navigationID.
     m_navigationState->didDestroyNavigation(navigationID);
 }