[Webkit-unassigned] [Bug 198320] [curl] Heap corruption in ~CurlResponse

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Jul 24 06:26:29 PDT 2019


--- Comment #5 from Fujii Hironori <Hironori.Fujii at sony.com> ---
Comment on attachment 374770
  --> https://bugs.webkit.org/attachment.cgi?id=374770

View in context: https://bugs.webkit.org/attachment.cgi?id=374770&action=review

> Source/WebCore/platform/network/curl/CurlRequest.cpp:597
> +        response.url = m_request.url();

You are incrementing ref counter of m_request.url() in the worker thread here.

> Source/WebCore/platform/network/curl/CurlRequest.cpp:601
> +        invokeDidReceiveResponse(response, Action::StartTransfer);

CurlResponse is destructed at the end of this lambda scope. It destructs the copied URL in the worker thread here.

You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190724/0bb44f64/attachment.html>

More information about the webkit-unassigned mailing list