Changeset 219514 in webkit

Timestamp:

Jul 14, 2017, 11:55:40 AM (8 years ago)

Author:

Chris Dumez

Message:

Potential null-dereference under NetworkRTCProvider::resolvedName()
​https://bugs.webkit.org/show_bug.cgi?id=174507
<rdar://problem/32597868>

Reviewed by Youenn Fablet.

NetworkRTCProvider::resolvedName() could do a null dereference of m_connection
because m_connection is nullified in NetworkRTCProvider::close() but resolvers
were only closed later on in the NetworkRTCProvider destructor.

To address the issue, we now stop DNS resolvers earlier, in NetworkRTCProvider::close().
Also fix unsafe modification of m_resolvers HashMap when iterating over it.

• NetworkProcess/webrtc/NetworkRTCProvider.cpp:

(WebKit::NetworkRTCProvider::~NetworkRTCProvider):
(WebKit::NetworkRTCProvider::close):
(WebKit::NetworkRTCProvider::Resolver::~Resolver):
(WebKit::NetworkRTCProvider::stopResolver):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/webrtc/NetworkRTCProvider.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2017-07-14  Chris Dumez  <cdumez@apple.com>
+
+        Potential null-dereference under NetworkRTCProvider::resolvedName()
+        https://bugs.webkit.org/show_bug.cgi?id=174507
+        <rdar://problem/32597868>
+
+        Reviewed by Youenn Fablet.
+
+        NetworkRTCProvider::resolvedName() could do a null dereference of m_connection
+        because m_connection is nullified in NetworkRTCProvider::close() but resolvers
+        were only closed later on in the NetworkRTCProvider destructor.
+
+        To address the issue, we now stop DNS resolvers earlier, in NetworkRTCProvider::close().
+        Also fix unsafe modification of m_resolvers HashMap when iterating over it.
+
+        * NetworkProcess/webrtc/NetworkRTCProvider.cpp:
+        (WebKit::NetworkRTCProvider::~NetworkRTCProvider):
+        (WebKit::NetworkRTCProvider::close):
+        (WebKit::NetworkRTCProvider::Resolver::~Resolver):
+        (WebKit::NetworkRTCProvider::stopResolver):
+
 2017-07-14  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebKit/NetworkProcess/webrtc/NetworkRTCProvider.cpp

@@ -70 +70 @@
     ASSERT(!m_sockets.size());
     ASSERT(!m_rtcMonitor.isStarted());
-
-    for (auto identifier : m_resolvers.keys())
-        stopResolver(identifier);
 }
 
 void NetworkRTCProvider::close()
 {
+    // Cancel all pending DNS resolutions.
+    while (!m_resolvers.isEmpty())
+        stopResolver(*m_resolvers.keys().begin());
+
     m_connection = nullptr;
     m_rtcMonitor.stopUpdating();
@@ -185 +186 @@
 void NetworkRTCProvider::stopResolver(uint64_t identifier)
 {
-    auto resolver = m_resolvers.take(identifier);
-    if (resolver)
+    ASSERT(identifier);
+    if (auto resolver = m_resolvers.take(identifier))
         CFHostCancelInfoResolution(resolver->host.get(), CFHostInfoType::kCFHostAddresses);
 }