223324 2021-03-16 23:39:07 -0700 memory leak 2023-11-02 12:13:17 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 1422930734 webkit-unassigned bfulgham darin mcatanzaro webkit-bug-importer oldest_to_newest 1740413 0 423440 1422930734 2021-03-16 23:39:07 -0700 Created attachment 423440 poc ==3031==ERROR: LeakSanitizer: detected memory leaks Direct leak of 1088 byte(s) in 6 object(s) allocated from: #0 0x4e0ee0 (/root/targets/targets/jsc_afl_asan18+0x4e0ee0) #1 0x695e87e (/root/targets/targets/jsc_afl_asan18+0x695e87e) SUMMARY: AddressSanitizer: 1088 byte(s) leaked in 6 allocation(s). 1740414 1 webkit-bug-importer 2021-03-16 23:39:17 -0700 <rdar://problem/75513657> 1740994 2 darin 2021-03-17 18:44:14 -0700 What would make a memory leak become an exploitable security issue? 1740998 3 1422930734 2021-03-17 18:59:03 -0700 (In reply to Darin Adler from comment #2) > What would make a memory leak become an exploitable security issue? A remote attacker with operation privilege could exploit the vulnerability by sending specific messages continuously. Successful exploit may cause some service abnormal 1989479 4 mcatanzaro 2023-11-02 12:13:17 -0700 WebKit is filled with memory leaks. The worst that's going to happen is an OOM kill. We don't track these as security bugs. Your report from LeakSanitizer would be a lot more useful if you built with debuginfo enabled, so we can see what's going on. But the poc is sufficient for a bug report. 423440 2021-03-16 23:39:07 -0700 2021-03-16 23:39:07 -0700 poc poc.js text/javascript 227 1422930734 ZnVuY3Rpb24gdjEoKXsKCSJBIi5yZXBsYWNlKCh7fSksICJDIik7Cn0KZm9yKHZhciB2MiA9IDA7 djIgPCAxMDAwMDt2MisrKXsKCQl2MSA9IHYxLmJpbmQoMSk7Cn0KZm9yKGxldCB2MCA9IDA7KHYw KSA8IDIwMDA7KXsKCW5ldyB2MSgiIiwgIiIsIDVlLTMyNCwgMjAwMCk7CglmdW5jdGlvbiB2Nih2 MSl7CgkJcmV0dXJuIChNYXRoLnJvdW5kKCgxMCkgKiAoMTAwMCkpKSAvICgxMDAwKTsKCX0KfQo=