Bug 144809

Summary: Fix possible race condition in BitmapImage::cacheFrame()
Product: WebKit Reporter: Said Abou-Hallawa <sabouhallawa>
Component: ImagesAssignee: Said Abou-Hallawa <sabouhallawa>
Status: RESOLVED INVALID    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch
none
Patch none

Said Abou-Hallawa
Reported 2015-05-08 13:10:04 PDT
In BitmapImage::cacheFrame(), we should check the frame metadata loading status before, asking the image source to provide information about its metadata. A crash was reported on iOS with the following call stack: CGImageSourceCopyPropertiesAtIndex() WebCore::ImageSource::frameDurationAtIndex(unsigned long) WebCore::BitmapImage::cacheFrameInfo(unsigned long) The crash happens in CGImageSourceCopyPropertiesAtIndex() when it is called from ImageSource::frameDurationAtIndex(). But before BitmapImage::cacheFrameInfo() calls ImageSource::frameDurationAtIndex(), it calls ImageSource::orientationAtIndex() which calls CGImageSourceCopyPropertiesAtIndex() with exactly the same parameters. Two possible scenarios may have happened here: 1) The frame metadata was not complete when CGImageSourceCopyPropertiesAtIndex() was called the first time so it returns null and we fall back to the default value case in ImageSource::orientationAtIndex(). But in the second time, the image metadata loading was in progress but not complete, so we end up reading from still not allocated memory buffer. 2) The frame metadata was complete when CGImageSourceCopyPropertiesAtIndex() was called the first time but the frame itself was freed when the second call was made, so end up reading from a freed memory block.
Attachments
Patch (4.11 KB, patch)
2015-05-08 13:13 PDT, Said Abou-Hallawa
no flags
Patch (4.70 KB, patch)
2015-05-08 13:24 PDT, Said Abou-Hallawa
no flags
Patch (4.69 KB, patch)
2015-05-08 14:55 PDT, Said Abou-Hallawa
no flags
Said Abou-Hallawa
Comment 1 2015-05-08 13:13:22 PDT
Said Abou-Hallawa
Comment 2 2015-05-08 13:24:16 PDT
Said Abou-Hallawa
Comment 3 2015-05-08 14:55:02 PDT
Said Abou-Hallawa
Comment 4 2015-05-14 09:02:13 PDT
The crash I suspected to be the result of this race condition has been fixed in one of the MacOS/iOS components. So this is not an issue anymore.
Note You need to log in before you can comment on or make changes to this bug.