Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 882406de5528596c018e2278507a75169ad4d8c3
https://github.com/WebKit/WebKit/commit/882406de5528596c018e2278507a75169ad4d8c3
Author: Ryosuke Niwa <[email protected]>
Date: 2025-08-11 (Mon, 11 Aug 2025)
Changed paths:
M Source/WebCore/Modules/encryptedmedia/NavigatorEME.cpp
M
Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations
Log Message:
-----------
Use-after-free of Document in MediaKeySystemAccess::MediaKeySystemAccess via
tryNextSupportedConfiguration
https://bugs.webkit.org/show_bug.cgi?id=292304
rdar://145888476
Reviewed by Eric Carlson and Brent Fulgham.
tryNextSupportedConfiguration should store Document in WeakPtr instead of a raw
reference to avoid accessing a dead document.
* Source/WebCore/Modules/encryptedmedia/NavigatorEME.cpp:
(WebCore::tryNextSupportedConfiguration):
*
Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:
Originally-landed-as: 289651.470@safari-7621-branch (6d042697c796).
rdar://157794831
Canonical link: https://commits.webkit.org/298534@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
