Changeset 260689 in webkit

Timestamp:

Apr 24, 2020 6:32:58 PM (4 years ago)

Author:

ddkilzer@apple.com

Message:

WebPasteboardProxy::getPasteboardStringsForType() and WebPasteboardProxy::readURLFromPasteboard() should check return value of SharedMemory::createHandle()
<​https://webkit.org/b/211002>

Reviewed by Wenson Hsieh.

• UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:

(WebKit::WebPasteboardProxy::getPasteboardBufferForType):
(WebKit::WebPasteboardProxy::readBufferFromPasteboard):

• Check result of SharedMemory::createHandle() and return early on failure.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/Cocoa/WebPasteboardProxyCocoa.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-24  David Kilzer  <ddkilzer@apple.com>
+
+        WebPasteboardProxy::getPasteboardStringsForType() and WebPasteboardProxy::readURLFromPasteboard() should check return value of SharedMemory::createHandle()
+        <https://webkit.org/b/211002>
+
+        Reviewed by Wenson Hsieh.
+
+        * UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
+        (WebKit::WebPasteboardProxy::getPasteboardBufferForType):
+        (WebKit::WebPasteboardProxy::readBufferFromPasteboard):
+        - Check result of SharedMemory::createHandle() and return early
+          on failure.
+
 2020-04-24  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm

@@ -186 +186 @@
     memcpy(sharedMemoryBuffer->data(), buffer->data(), size);
     SharedMemory::Handle handle;
-    sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly);
+    if (!sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly))
+        return completionHandler({ }, 0);
     completionHandler(WTFMove(handle), size);
 }
@@ -388 +389 @@
     memcpy(sharedMemoryBuffer->data(), buffer->data(), size);
     SharedMemory::Handle handle;
-    sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly);
+    if (!sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly))
+        return completionHandler({ }, 0);
     completionHandler(WTFMove(handle), size);
 }