[Webkit-unassigned] [Bug 198320] [curl] Heap corruption in ~CurlResponse

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=198320

--- Comment #6 from Takashi Komori <Takashi.Komori at sony.com> ---
(In reply to Fujii Hironori from comment #5)
> Comment on attachment 374770 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=374770&action=review
> 
> > Source/WebCore/platform/network/curl/CurlRequest.cpp:597
> > +        response.url = m_request.url();
> 
> You are incrementing ref counter of m_request.url() in the worker thread
> here.
> 
> > Source/WebCore/platform/network/curl/CurlRequest.cpp:601
> > +        invokeDidReceiveResponse(response, Action::StartTransfer);
> 
> CurlResponse is destructed at the end of this lambda scope. It destructs the
> copied URL in the worker thread here.

m_request object should be reffered by only worker thread except in contructor.
So the operation in lamda is valid.
(In reply to Fujii Hironori from comment #5)
> Comment on attachment 374770 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=374770&action=review
> 
> > Source/WebCore/platform/network/curl/CurlRequest.cpp:597
> > +        response.url = m_request.url();
> 
> You are incrementing ref counter of m_request.url() in the worker thread
> here.
> 
> > Source/WebCore/platform/network/curl/CurlRequest.cpp:601
> > +        invokeDidReceiveResponse(response, Action::StartTransfer);
> 
> CurlResponse is destructed at the end of this lambda scope. It destructs the
> copied URL in the worker thread here.

m_request object should be reffered by only worker thread except in constructor.
So copying URL in the lamda is valid.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190725/6277db60/attachment-0001.html>