Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 629adf4b07f2d5d71ff096c95de0ed67da38ded5
https://github.com/WebKit/WebKit/commit/629adf4b07f2d5d71ff096c95de0ed67da38ded5
Author: Chris Dumez <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M Source/WebCore/fileapi/AsyncFileStream.cpp
M Source/WebCore/fileapi/AsyncFileStream.h
M Source/WebCore/platform/FileStreamClient.h
M Source/WebCore/platform/network/BlobResourceHandle.cpp
M Source/WebCore/platform/network/BlobResourceHandleBase.cpp
M Source/WebCore/platform/network/BlobResourceHandleBase.h
M Source/WebKit/NetworkProcess/NetworkDataTaskBlob.cpp
Log Message:
-----------
Cross-Thread UAF Write in AsyncFileStream::read via NetworkDataTaskBlob
https://bugs.webkit.org/show_bug.cgi?id=312449
rdar://174655475
Reviewed by Ryosuke Niwa.
BlobResourceHandleBase was passing a mutable span to its m_buffer Vector
to AsyncFileStream for it to write into asynchronously on a background
thread. However, nothing guaranteed that the BlobResourceHandleBase
(and thus its m_buffer) stayed alive until AsyncFileStream was done
writing.
Address the issue by using a `Box<Vector<uint8_t>>` instead of a simple
Vector so that the buffer is now ThreadSafeRefCounted. Then update the
AsyncFileStream API to take in a `Box<Vector<uint8_t>>` instead of a
span.
For further hardening, I removed the non-const buffer getter on
BlobResourceHandleBase. This was too dangerous because any operation on
this buffer on the main thread could cause the background thread to
crash if it is currently writing to it. The non-const buffer getter was
only used to resize the buffer once we know the size of the data we
need to read. I thus added a more specific `resizeBuffer()` API to
BlobResourceHandleBase which has a RELEASE_ASSERT() to guarantee that
the background thread is NOT currently writing into the buffer. This was
not an issue with the current code but the RELEASE_ASSERT() makes sure
we cannot introduce such a security bug in the future.
* Source/WebCore/fileapi/AsyncFileStream.cpp:
(WebCore::AsyncFileStream::read):
* Source/WebCore/fileapi/AsyncFileStream.h:
* Source/WebCore/platform/FileStreamClient.h:
(WebCore::FileStreamClient::didGetSize):
(WebCore::FileStreamClient::didRead): Deleted.
* Source/WebCore/platform/network/BlobResourceHandle.cpp:
(WebCore::BlobResourceHandle::didReceiveResponse):
* Source/WebCore/platform/network/BlobResourceHandleBase.cpp:
(WebCore::BlobResourceHandleBase::BlobResourceHandleBase):
(WebCore::BlobResourceHandleBase::resizeBuffer):
(WebCore::BlobResourceHandleBase::readFileAsync):
(WebCore::BlobResourceHandleBase::didRead):
* Source/WebCore/platform/network/BlobResourceHandleBase.h:
* Source/WebKit/NetworkProcess/NetworkDataTaskBlob.cpp:
(WebKit::NetworkDataTaskBlob::didReceiveResponse):
Originally-landed-as: 305413.682@safari-7624-branch (70917758773a).
rdar://180428931
Canonical link: https://commits.webkit.org/316253@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
