Changeset 210357 in webkit

Timestamp:

Jan 5, 2017 9:30:57 AM (7 years ago)

Author:

commit-queue@webkit.org

Message:

[SOUP] AddressSanitizer: heap-use-after-free under WTF::String::fromUTF8()
​https://bugs.webkit.org/show_bug.cgi?id=166722

Patch by Milan Crha <​mcrha@redhat.com> on 2017-01-05
Reviewed by Alex Christensen.

• platform/soup/PublicSuffixSoup.cpp:

(WebCore::topPrivatelyControlledDomain):
Use a variable to hold UTF-8 version of the domain, because
the soup_tld_get_base_domain() returns a pointer into the passed-in
string, which could be freed due to the temporary object being freed.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/soup/PublicSuffixSoup.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-01-05  Milan Crha  <mcrha@redhat.com>
+
+        [SOUP] AddressSanitizer: heap-use-after-free under WTF::String::fromUTF8()
+        https://bugs.webkit.org/show_bug.cgi?id=166722
+
+        Reviewed by Alex Christensen.
+
+        * platform/soup/PublicSuffixSoup.cpp:
+        (WebCore::topPrivatelyControlledDomain):
+        Use a variable to hold UTF-8 version of the domain, because
+        the soup_tld_get_base_domain() returns a pointer into the passed-in
+        string, which could be freed due to the temporary object being freed.
+
 2017-01-05  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebCore/platform/soup/PublicSuffixSoup.cpp

@@ -48 +48 @@
 
     GUniqueOutPtr<GError> error;
-    if (const char* baseDomain = soup_tld_get_base_domain(domain.utf8().data(), &error.outPtr()))
+    CString domainUTF8 = domain.utf8();
+    if (const char* baseDomain = soup_tld_get_base_domain(domainUTF8.data(), &error.outPtr()))
         return String::fromUTF8(baseDomain);