Changeset 266140 in webkit

Timestamp:

Aug 25, 2020, 12:09:16 PM (5 years ago)

Author:

achristensen@apple.com

Message:

Fix read-after-free introduced in r266087
​https://bugs.webkit.org/show_bug.cgi?id=215671

• Modules/fetch/FetchBodyConsumer.cpp:

(WebCore::packageFormData):
Keep the CString in scope while we are using it.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/fetch/FetchBodyConsumer.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-08-25  Alex Christensen  <achristensen@webkit.org>
+
+        Fix read-after-free introduced in r266087
+        https://bugs.webkit.org/show_bug.cgi?id=215671
+
+        * Modules/fetch/FetchBodyConsumer.cpp:
+        (WebCore::packageFormData):
+        Keep the CString in scope while we are using it.
+
 2020-08-25  Andres Gonzalez  <andresg_22@apple.com>
 

trunk/Source/WebCore/Modules/fetch/FetchBodyConsumer.cpp

@@ -188 +188 @@
     if (auto multipartBoundary = parseMultipartBoundary(mimeType)) {
         String boundaryWithDashes = makeString("--", *multipartBoundary);
-        const char* boundary = boundaryWithDashes.utf8().data();
-        size_t boundaryLength = strlen(boundary);
-
-        const char* currentBoundary = static_cast<const char*>(memmem(data, length, boundary, boundaryLength));
+        CString boundary = boundaryWithDashes.utf8();
+        size_t boundaryLength = boundary.length();
+
+        const char* currentBoundary = static_cast<const char*>(memmem(data, length, boundary.data(), boundaryLength));
         if (!currentBoundary)
             return nullptr;
-        const char* nextBoundary = static_cast<const char*>(memmem(currentBoundary + boundaryLength, length - (currentBoundary + boundaryLength - data), boundary, boundaryLength));
+        const char* nextBoundary = static_cast<const char*>(memmem(currentBoundary + boundaryLength, length - (currentBoundary + boundaryLength - data), boundary.data(), boundaryLength));
         if (!nextBoundary)
             return nullptr;
@@ -200 +200 @@
             parseMultipartPart(currentBoundary + boundaryLength, nextBoundary - currentBoundary - boundaryLength - strlen("\r\n"), form.get());
             currentBoundary = nextBoundary;
-            nextBoundary = static_cast<const char*>(memmem(nextBoundary + boundaryLength, length - (nextBoundary + boundaryLength - data), boundary, boundaryLength));
+            nextBoundary = static_cast<const char*>(memmem(nextBoundary + boundaryLength, length - (nextBoundary + boundaryLength - data), boundary.data(), boundaryLength));
         }
     } else if (mimeType && equalIgnoringASCIICase(mimeType->type, "application") && equalIgnoringASCIICase(mimeType->subtype, "x-www-form-urlencoded")) {