Changeset 266416 in webkit

Timestamp:

Sep 1, 2020 3:56:19 PM (4 years ago)

Author:

Kate Cheney

Message:

WebPasteboardProxy::getPasteboardStringsForType() and WebPasteboardProxy::readURLFromPasteboard() should check return value of SharedMemory::createHandle()
​https://bugs.webkit.org/show_bug.cgi?id=211002
<rdar://problem/60103950>

Reviewed by Wenson Hsieh.

• UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:

(WebKit::WebPasteboardProxy::getPasteboardBufferForType):
(WebKit::WebPasteboardProxy::readBufferFromPasteboard):
Check result of SharedMemory::createHandle() and return early
on failure.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/Cocoa/WebPasteboardProxyCocoa.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-09-01  Kate Cheney  <katherine_cheney@apple.com>
+
+        WebPasteboardProxy::getPasteboardStringsForType() and WebPasteboardProxy::readURLFromPasteboard() should check return value of SharedMemory::createHandle()
+        https://bugs.webkit.org/show_bug.cgi?id=211002
+        <rdar://problem/60103950>
+
+        Reviewed by Wenson Hsieh.
+
+        * UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
+        (WebKit::WebPasteboardProxy::getPasteboardBufferForType):
+        (WebKit::WebPasteboardProxy::readBufferFromPasteboard):
+        Check result of SharedMemory::createHandle() and return early
+        on failure.
+
 2020-09-01  Hector Lopez  <hector_i_lopez@apple.com>
 

trunk/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm

@@ -214 +214 @@
     memcpy(sharedMemoryBuffer->data(), buffer->data(), size);
     SharedMemory::Handle handle;
-    sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly);
+    if (!sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly))
+        return completionHandler({ });
     completionHandler(SharedMemory::IPCHandle { WTFMove(handle), size });
 }
@@ -431 +432 @@
     memcpy(sharedMemoryBuffer->data(), buffer->data(), size);
     SharedMemory::Handle handle;
-    sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly);
+    if (!sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly))
+        return completionHandler({ });
     completionHandler(SharedMemory::IPCHandle { WTFMove(handle), size });
 }