Bug 206018

Summary: TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: Tools / TestsAssignee: David Kilzer (:ddkilzer) <ddkilzer>
Severity: Normal CC: commit-queue, darin, joepeck, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=205950
Description Flags
Patch v1 none

Description David Kilzer (:ddkilzer) 2020-01-09 11:03:15 PST
TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString.

This will result in a use-after-free if the const char* pointer is accessed after the NSString object has been released.

This is not currently crashing because WTR::TestController::TestController() leaks autoreleased objects into a top-level autoreleasePool that's never cleared (which was NOT fixed by Bug 205950).
Comment 1 Radar WebKit Bug Importer 2020-01-09 11:05:06 PST
Comment 2 David Kilzer (:ddkilzer) 2020-01-09 12:09:49 PST
Created attachment 387252 [details]
Patch v1
Comment 3 WebKit Commit Bot 2020-01-09 18:10:25 PST
Comment on attachment 387252 [details]
Patch v1

Clearing flags on attachment: 387252

Committed r254318: <https://trac.webkit.org/changeset/254318>
Comment 4 WebKit Commit Bot 2020-01-09 18:10:27 PST
All reviewed patches have been landed.  Closing bug.