Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d643555ed4f5ce21f793190d467008b2e0754ccf
https://github.com/WebKit/WebKit/commit/d643555ed4f5ce21f793190d467008b2e0754ccf
Author: Chris Dumez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WTF/wtf/MappedFileData.h
M Source/WTF/wtf/posix/FileHandlePOSIX.cpp
M Source/WTF/wtf/posix/MappedFileDataPOSIX.cpp
M Source/WTF/wtf/win/FileHandleWin.cpp
M Source/WTF/wtf/win/MappedFileDataWin.cpp
M Source/WebCore/platform/network/BlobData.cpp
M Source/WebCore/platform/network/BlobData.h
M Source/WebCore/platform/network/BlobDataFileReference.cpp
M Source/WebCore/platform/network/BlobDataFileReference.h
M Tools/TestWebKitAPI/Tests/WTF/FileSystem.cpp
Log Message:
-----------
Cross-Thread Destruction of BlobData Races Non-Thread-Safe
RefCounted<BlobDataFileReference> Leads to UAF
https://bugs.webkit.org/show_bug.cgi?id=312734
rdar://174674094
Reviewed by Ryosuke Niwa.
BlobData was ThreadSafeRefCounted but contained data members that were
not safe to destroy on other threads like a String and a
`RefPtr<BlobDataFileReference>` (BlobDataFileReference only subclasses
RefCounted). For thread safety, both BlobData and BlobDataFileReference
now subclass `ThreadSafeRefCounted<T, WTF::DestructionThread::Main>` so
that not only their ref-counting is atomic but also to guarantee that
they get destroyed on the main thread (since they are always constructed
on the main thread). This is important given that they have String
data members.
Also, as further hardening recommended by the AI, update MappedFileData
to be able to distinguish empty data and invalid data.
* Source/WTF/wtf/MappedFileData.h:
(WTF::FileSystemImpl::MappedFileData::emptyFile):
(WTF::FileSystemImpl::MappedFileData::operator bool const):
(WTF::FileSystemImpl::MappedFileData::leakHandle):
(WTF::FileSystemImpl::MappedFileData::fileMapping const):
* Source/WTF/wtf/posix/FileHandlePOSIX.cpp:
(WTF::FileSystemImpl::FileHandle::map):
* Source/WTF/wtf/posix/MappedFileDataPOSIX.cpp:
(WTF::FileSystemImpl::MappedFileData::MappedFileData):
* Source/WTF/wtf/win/FileHandleWin.cpp:
(WTF::FileSystemImpl::FileHandle::map):
* Source/WTF/wtf/win/MappedFileDataWin.cpp:
(WTF::FileSystemImpl::MappedFileData::MappedFileData):
* Source/WebCore/platform/network/BlobData.cpp:
(WebCore::BlobData::BlobData):
* Source/WebCore/platform/network/BlobData.h:
* Source/WebCore/platform/network/BlobDataFileReference.cpp:
(WebCore::BlobDataFileReference::BlobDataFileReference):
* Source/WebCore/platform/network/BlobDataFileReference.h:
Originally-landed-as: 305413.709@safari-7624-branch (5b1739a247ed).
rdar://180438123
Canonical link: https://commits.webkit.org/316216@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
