Changeset 117108 in webkit

Timestamp:

May 15, 2012 11:51:02 AM (12 years ago)

Author:

kling@webkit.org

Message:

Deep copy PluginModuleInfo before passing across thread boundary.
<​http://webkit.org/b/86491>
<rdar://problem/11451178>

Reviewed by Anders Carlsson.

Source/WebCore:

• plugins/PluginData.h:

(MimeClassInfo):
(WebCore::MimeClassInfo::isolatedCopy):
(PluginInfo):
(WebCore::PluginInfo::isolatedCopy):

Source/WebKit2:

Since the vector of PluginModuleInfo objects returned by PluginInfoStore::plugins()
can end up being passed to another thread, we should clone it to make sure it's
safe to do so.

No new tests, speculative use-after-free fix.

• Shared/Plugins/PluginModuleInfo.h:

(PluginModuleInfo):
(WebKit::PluginModuleInfo::isolatedCopy):

• UIProcess/Plugins/PluginInfoStore.cpp:

(WebKit::PluginInfoStore::plugins):

Location:

trunk/Source

Files:

• WebCore/ChangeLog (modified) (1 diff)
• WebCore/plugins/PluginData.h (modified) (2 diffs)
• WebKit2/ChangeLog (modified) (1 diff)
• WebKit2/Shared/Plugins/PluginModuleInfo.h (modified) (1 diff)
• WebKit2/UIProcess/Plugins/PluginInfoStore.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-05-15  Andreas Kling  <kling@webkit.org>
+
+        Deep copy PluginModuleInfo before passing across thread boundary.
+        <http://webkit.org/b/86491>
+        <rdar://problem/11451178>
+
+        Reviewed by Anders Carlsson.
+
+        * plugins/PluginData.h:
+        (MimeClassInfo):
+        (WebCore::MimeClassInfo::isolatedCopy):
+        (PluginInfo):
+        (WebCore::PluginInfo::isolatedCopy):
+
 2012-05-15  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/Source/WebCore/plugins/PluginData.h

@@ -34 +34 @@
     String desc;
     Vector<String> extensions;
+
+    MimeClassInfo isolatedCopy()
+    {
+        MimeClassInfo clone;
+        clone.type = type.isolatedCopy();
+        clone.desc = desc.isolatedCopy();
+        for (unsigned i = 0; i < extensions.size(); ++i)
+            clone.extensions.append(extensions[i].isolatedCopy());
+        return clone;
+    }
 };
 
@@ -46 +56 @@
     String desc;
     Vector<MimeClassInfo> mimes;
+
+    PluginInfo isolatedCopy()
+    {
+        PluginInfo clone;
+        clone.name = name.isolatedCopy();
+        clone.file = file.isolatedCopy();
+        clone.desc = desc.isolatedCopy();
+        for (unsigned i = 0; i < mimes.size(); ++i)
+            clone.mimes.append(mimes[i].isolatedCopy());
+        return clone;
+    }
 };
 

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2012-05-15  Andreas Kling  <kling@webkit.org>
+
+        Deep copy PluginModuleInfo before passing across thread boundary.
+        <http://webkit.org/b/86491>
+        <rdar://problem/11451178>
+
+        Reviewed by Anders Carlsson.
+
+        Since the vector of PluginModuleInfo objects returned by PluginInfoStore::plugins()
+        can end up being passed to another thread, we should clone it to make sure it's
+        safe to do so.
+
+        No new tests, speculative use-after-free fix.
+
+        * Shared/Plugins/PluginModuleInfo.h:
+        (PluginModuleInfo):
+        (WebKit::PluginModuleInfo::isolatedCopy):
+        * UIProcess/Plugins/PluginInfoStore.cpp:
+        (WebKit::PluginInfoStore::plugins):
+
 2012-05-15  Andy Estes  <aestes@apple.com>
 

trunk/Source/WebKit2/Shared/Plugins/PluginModuleInfo.h

@@ -42 +42 @@
     uint64_t fileVersion;
 #endif
+
+    PluginModuleInfo isolatedCopy()
+    {
+        PluginModuleInfo clone;
+        clone.path = path.isolatedCopy();
+        clone.info = info.isolatedCopy();
+#if PLATFORM(MAC)
+        clone.pluginArchitecture = pluginArchitecture;
+        clone.bundleIdentifier = bundleIdentifier.isolatedCopy();
+        clone.versionString = versionString.isolatedCopy();
+#elif PLATFORM(WIN)
+        clone.fileVersion = fileVersion;
+#endif
+        return clone;
+    }
 };
 

trunk/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp

@@ -116 +116 @@
     MutexLocker locker(m_pluginsLock);
     loadPluginsIfNecessary();
-    return m_plugins;
+
+    // Let the copy begin!
+    Vector<PluginModuleInfo> infos;
+    for (unsigned i = 0; i < m_plugins.size(); ++i)
+        infos.append(m_plugins[i].isolatedCopy());
+
+    return infos;
 }