[Webkit-unassigned] [Bug 198320] [curl] Heap corruption in ~CurlResponse

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=198320

--- Comment #5 from Fujii Hironori <Hironori.Fujii at sony.com> ---
Comment on attachment 374770
  --> https://bugs.webkit.org/attachment.cgi?id=374770
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=374770&action=review

> Source/WebCore/platform/network/curl/CurlRequest.cpp:597
> +        response.url = m_request.url();

You are incrementing ref counter of m_request.url() in the worker thread here.

> Source/WebCore/platform/network/curl/CurlRequest.cpp:601
> +        invokeDidReceiveResponse(response, Action::StartTransfer);

CurlResponse is destructed at the end of this lambda scope. It destructs the copied URL in the worker thread here.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190724/0bb44f64/attachment.html>