Changeset 91157 in webkit

Timestamp:

Jul 16, 2011 4:29:29 PM (13 years ago)

Author:

psolanki@apple.com

Message:

SubresourceLoader::didReceiveDataArray can crash when calling m_client->didReceiveData()
​https://bugs.webkit.org/show_bug.cgi?id=64656
<rdar://problem/9754425>

Reviewed by Alexey Proskuryakov.

• loader/cf/SubresourceLoaderCF.cpp:

(WebCore::SubresourceLoader::didReceiveDataArray): Check for m_client before calling
m_client->didReceiveData().

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/cf/SubresourceLoaderCF.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-16  Pratik Solanki  <psolanki@apple.com>
+
+        SubresourceLoader::didReceiveDataArray can crash when calling m_client->didReceiveData()
+        https://bugs.webkit.org/show_bug.cgi?id=64656
+        <rdar://problem/9754425>
+
+        Reviewed by Alexey Proskuryakov.
+
+        * loader/cf/SubresourceLoaderCF.cpp:
+        (WebCore::SubresourceLoader::didReceiveDataArray): Check for m_client before calling
+        m_client->didReceiveData().
+
 2011-07-16  Dinu Jacob  <dinu.jacob@nokia.com>
 

trunk/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp

@@ -41 +41 @@
     // A subresource loader does not load multipart sections progressively.
     // So don't deliver any data to the loader yet.
-    if (!m_loadingMultipartContent && m_client) {
+    if (!m_loadingMultipartContent) {
         CFIndex arrayCount = CFArrayGetCount(dataArray);
         for (CFIndex i = 0; i < arrayCount; ++i)  {
+            if (!m_client)
+                break;
             CFDataRef data = reinterpret_cast<CFDataRef>(CFArrayGetValueAtIndex(dataArray, i));
             m_client->didReceiveData(this, reinterpret_cast<const char *>(CFDataGetBytePtr(data)), static_cast<int>(CFDataGetLength(data)));