215976 2020-08-29 02:17:37 -0700 [GTK] REGRESSION(r150392) insufficient space allocation results in heap corruption 2020-08-30 02:40:49 -0700 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 jmason webkit-unassigned benjamin bugs-noreply cdumez cgarcia cmarcelo ews-watchlist oldest_to_newest 1683908 0 jmason 2020-08-29 02:17:37 -0700 The change introduced by the patch for 150392 fails to allocate enough space for the new RunLoopSource struct in the TimerBase ctor, resulting in a segmentation fault due to heap corruption: (gdb) bt #0 0x00007ffaa94e30d1 in _malloc_unlocked () at /lib/64/libc.so.1 #1 0x00007ffaa94e2f14 in malloc () at /lib/64/libc.so.1 #2 0x00007ffaa94caaef in calloc () at /lib/64/libc.so.1 #3 0x00007ffaa8f90189 in g_malloc0 () at /usr/lib/64/libglib-2.0.so.0 #4 0x00007ffaa8f864fb in g_source_new () at /usr/lib/64/libglib-2.0.so.0 #5 0x00007ffa9edcc6f4 in WTF::RunLoop::TimerBase::TimerBase(WTF::RunLoop&) () 1683909 1 407537 jmason 2020-08-29 02:18:44 -0700 Created attachment 407537 Patch 1683998 2 407537 cgarcia 2020-08-30 02:24:22 -0700 Comment on attachment 407537 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=407537&action=review Thanks! > Source/WTF/wtf/glib/RunLoopGLib.cpp:162 > - , m_source(adoptGRef(g_source_new(&RunLoop::s_runLoopSourceFunctions, sizeof(GSource)))) > + , m_source(adoptGRef(g_source_new(&RunLoop::s_runLoopSourceFunctions, sizeof(RunLoopSource)))) Oops, I forgot this one. 1684005 3 ews-feeder 2020-08-30 02:40:47 -0700 Committed r266331: <https://trac.webkit.org/changeset/266331> All reviewed patches have been landed. Closing bug and clearing flags on attachment 407537. 407537 2020-08-29 02:18:44 -0700 2020-08-30 02:40:48 -0700 Patch bug-215976-20200829101843.patch text/plain 1329 jmason SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAyNjYzMjQpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDIwLTA4LTI5ICBKaW0gTWFzb24gIDxqbWFzb25A aWJpbnguY29tPgorCisgICAgICAgIFtHVEtdIFJFR1JFU1NJT04ocjE1MDM5MikgaW5zdWZmaWNp ZW50IHNwYWNlIGFsbG9jYXRpb24gcmVzdWx0cyBpbiBoZWFwIGNvcnJ1cHRpb24KKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxNTk3NgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogd3RmL2dsaWIvUnVuTG9v cEdMaWIuY3BwOgorICAgICAgICAoV1RGOjpSdW5Mb29wOjpUaW1lckJhc2U6OlRpbWVyQmFzZSk6 CisKIDIwMjAtMDgtMjcgIFN0ZXBoYW4gU3phYm8gIDxzdGVwaGFuLnN6YWJvQHNvbnkuY29tPgog CiAgICAgICAgIFtQbGF5U3RhdGlvbl0gQnVpbGQgZml4IGR1ZSB0byBtZW1tZW0gbm90IGFsd2F5 cyBiZWluZyBhdmFpbGFibGUuCkluZGV4OiBTb3VyY2UvV1RGL3d0Zi9nbGliL1J1bkxvb3BHTGli LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV1RGL3d0Zi9nbGliL1J1bkxvb3BHTGliLmNwcAko cmV2aXNpb24gMjY2MzI0KQorKysgU291cmNlL1dURi93dGYvZ2xpYi9SdW5Mb29wR0xpYi5jcHAJ KHdvcmtpbmcgY29weSkKQEAgLTE1OSw3ICsxNTksNyBAQCB2b2lkIFJ1bkxvb3A6Om5vdGlmeShS dW5Mb29wOjpFdmVudCBldmVuCiAKIFJ1bkxvb3A6OlRpbWVyQmFzZTo6VGltZXJCYXNlKFJ1bkxv b3AmIHJ1bkxvb3ApCiAgICAgOiBtX3J1bkxvb3AocnVuTG9vcCkKLSAgICAsIG1fc291cmNlKGFk b3B0R1JlZihnX3NvdXJjZV9uZXcoJlJ1bkxvb3A6OnNfcnVuTG9vcFNvdXJjZUZ1bmN0aW9ucywg c2l6ZW9mKEdTb3VyY2UpKSkpCisgICAgLCBtX3NvdXJjZShhZG9wdEdSZWYoZ19zb3VyY2VfbmV3 KCZSdW5Mb29wOjpzX3J1bkxvb3BTb3VyY2VGdW5jdGlvbnMsIHNpemVvZihSdW5Mb29wU291cmNl KSkpKQogewogICAgIGF1dG8mIHJ1bkxvb3BTb3VyY2UgPSAqcmVpbnRlcnByZXRfY2FzdDxSdW5M b29wU291cmNlKj4obV9zb3VyY2UuZ2V0KCkpOwogICAgIHJ1bkxvb3BTb3VyY2UucnVuTG9vcCA9 IG1fcnVuTG9vcC5wdHIoKTsK