[Webkit-unassigned] [Bug 207420] New: UAF in GeoclueGeolocationProvider

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=207420

            Bug ID: 207420
           Summary: UAF in GeoclueGeolocationProvider
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKitGTK
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: pfeldman at chromium.org
                CC: bugs-noreply at webkitgtk.org

GeoclueGeolocationProvider makes non-cancelable g_dbus_proxy_call(s) with bare this pointer. This results in use after free in case geolocation object is deleted before callback is fired.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200208/9f3e4228/attachment.htm>