Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 96745ccf6bd5864a129ca805c99acbad073f07e3
https://github.com/WebKit/WebKit/commit/96745ccf6bd5864a129ca805c99acbad073f07e3
Author: Youenn Fablet <you...@apple.com>
Date: 2025-08-19 (Tue, 19 Aug 2025)
Changed paths:
M
Source/ThirdParty/libwebrtc/Source/webrtc/net/dcsctp/tx/outstanding_data.cc
M Source/ThirdParty/libwebrtc/Source/webrtc/net/dcsctp/tx/outstanding_data.h
Log Message:
-----------
com.apple.WebKit.WebContent use-after-free crash at libwebrtc.dylib:
dcsctp::TransmissionControlBlock::SendBufferedPackets
rdar://150587630
Reviewed by David Kilzer.
Instead of modifying outstanding_data_ while iterating it, we iterate
outstanding_data_ and put copies of its Items to be processed in a separate
deque.
We then iterate through the vector to do the processing.
We add an enqueue routine to share code between the two places where
outstanding_data_ is iterated/modified.
* Source/ThirdParty/libwebrtc/Source/webrtc/net/dcsctp/tx/outstanding_data.cc:
* Source/ThirdParty/libwebrtc/Source/webrtc/net/dcsctp/tx/outstanding_data.h:
Originally-landed-as: 289651.536@safari-7621-branch (c609e634bb2f).
rdar://157791161
Canonical link: https://commits.webkit.org/298910@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
