Bug 206018

Summary:

TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString

Product:

WebKit

Reporter:

David Kilzer (:ddkilzer) <ddkilzer>

Component:

Tools / Tests

Assignee:

David Kilzer (:ddkilzer) <ddkilzer>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

commit-queue, darin, joepeck, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

See Also:

https://bugs.webkit.org/show_bug.cgi?id=205950

Attachments:

Description	Flags
Patch v1	none

Description David Kilzer (:ddkilzer) 2020-01-09 11:03:15 PST

TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString.

This will result in a use-after-free if the const char* pointer is accessed after the NSString object has been released.

This is not currently crashing because WTR::TestController::TestController() leaks autoreleased objects into a top-level autoreleasePool that's never cleared (which was NOT fixed by Bug 205950).

Comment 1 Radar WebKit Bug Importer 2020-01-09 11:05:06 PST

<rdar://problem/58449733>

Comment 2 David Kilzer (:ddkilzer) 2020-01-09 12:09:49 PST

Created attachment 387252 [details]
Patch v1

Comment 3 WebKit Commit Bot 2020-01-09 18:10:25 PST

Comment on attachment 387252 [details]
Patch v1

Clearing flags on attachment: 387252

Committed r254318: <https://trac.webkit.org/changeset/254318>

Comment 4 WebKit Commit Bot 2020-01-09 18:10:27 PST

All reviewed patches have been landed.  Closing bug.