Changeset 280831 in webkit

Timestamp:

Aug 10, 2021, 2:22:45 AM (5 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r274027 - [IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
​https://bugs.webkit.org/show_bug.cgi?id=222842
<rdar://problem/75119560>

Reviewed by Darin Adler.

• UIProcess/WebNavigationState.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didDestroyNavigation):

Location:

releases/WebKitGTK/webkit-2.32/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebNavigationState.h (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (2 diffs)

releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-05  Chris Dumez  <cdumez@apple.com>
+
+        [IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
+        https://bugs.webkit.org/show_bug.cgi?id=222842
+        <rdar://problem/75119560>
+
+        Reviewed by Darin Adler.
+
+        * UIProcess/WebNavigationState.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didDestroyNavigation):
+
 2021-07-23  Adrian Perez de Castro  <aperez@igalia.com>
 

releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebNavigationState.h

@@ -68 +68 @@
     }
 
+    using NavigationMap = HashMap<uint64_t, RefPtr<API::Navigation>>;
+
 private:
-    HashMap<uint64_t, RefPtr<API::Navigation>> m_navigations;
+    NavigationMap m_navigations;
     uint64_t m_navigationID { 0 };
 };

releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -4383 +4383 @@
 void WebPageProxy::didDestroyNavigation(uint64_t navigationID)
 {
+    MESSAGE_CHECK(m_process, WebNavigationState::NavigationMap::isValidKey(navigationID));
+
     PageClientProtector protector(pageClient());
 
@@ -4389 +4391 @@
         return;
 
-    // FIXME: Message check the navigationID.
     m_navigationState->didDestroyNavigation(navigationID);
 }