Changeset 182602 in webkit

Timestamp:

Apr 9, 2015 9:20:21 AM (9 years ago)

Author:

Antti Koivisto

Message:

Network Cache: Crash in WebCore::CachedResource::tryReplaceEncodedData
​https://bugs.webkit.org/show_bug.cgi?id=143562

Reviewed by Anders Carlsson.

If another thread comes and truncates the file before we map it we end up with a map that crashes when accessed.

• NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm:

(WebKit::NetworkCache::IOChannel::IOChannel):

When creating a new file unlink any existing file instead of using O_TRUNC.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm (modified) (3 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-04-09  Antti Koivisto  <antti@apple.com>
+
+        Network Cache: Crash in WebCore::CachedResource::tryReplaceEncodedData
+        https://bugs.webkit.org/show_bug.cgi?id=143562
+
+        Reviewed by Anders Carlsson.
+
+        If another thread comes and truncates the file before we map it we end up with a map that crashes when accessed.
+
+        * NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm:
+        (WebKit::NetworkCache::IOChannel::IOChannel):
+
+            When creating a new file unlink any existing file instead of using O_TRUNC.
+
 2015-04-09  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/WebKit2/NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm

@@ -44 +44 @@
     , m_type(type)
 {
+    auto path = WebCore::fileSystemRepresentation(filePath);
     int oflag;
     mode_t mode;
@@ -49 +50 @@
     switch (m_type) {
     case Type::Create:
-        oflag = O_RDWR | O_CREAT | O_TRUNC | O_NONBLOCK;
+        // We don't want to truncate any existing file (with O_TRUNC) as another thread might be mapping it.
+        unlink(path.data());
+        oflag = O_RDWR | O_CREAT | O_NONBLOCK;
         mode = S_IRUSR | S_IWUSR;
         break;
@@ -61 +64 @@
     }
 
-    CString path = WebCore::fileSystemRepresentation(filePath);
     int fd = ::open(path.data(), oflag, mode);
     m_fileDescriptor = fd;