Bug 206018

Summary: TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: Tools / TestsAssignee: David Kilzer (:ddkilzer) <ddkilzer>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, darin, joepeck, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=205950
Attachments:
Description Flags
Patch v1 none

David Kilzer (:ddkilzer)
Reported 2020-01-09 11:03:15 PST
TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString. This will result in a use-after-free if the const char* pointer is accessed after the NSString object has been released. This is not currently crashing because WTR::TestController::TestController() leaks autoreleased objects into a top-level autoreleasePool that's never cleared (which was NOT fixed by Bug 205950).
Attachments
Patch v1 (3.43 KB, patch)
2020-01-09 12:09 PST, David Kilzer (:ddkilzer) 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2020-01-09 11:05:06 PST
<rdar://problem/58449733>
David Kilzer (:ddkilzer)
Comment 2 2020-01-09 12:09:49 PST
Created attachment 387252 [details] Patch v1
WebKit Commit Bot
Comment 3 2020-01-09 18:10:25 PST
Comment on attachment 387252 [details] Patch v1 Clearing flags on attachment: 387252 Committed r254318: <https://trac.webkit.org/changeset/254318>
WebKit Commit Bot
Comment 4 2020-01-09 18:10:27 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.