Bug 213035 – Crash growing a CFData with incremental PDF loading

• Component: WebKit Misc.
• Status: RESOLVED FIXED

[Brady Eidson]

Crash growing a CFData with incremental PDF loading

<rdar://problem/63670403>

[Brady Eidson]

Created attachment 401584 [details]
Patch

[Alex Christensen]

Comment on attachment 401584 [details]
Patch

Shouldn't we call CFDataIncreaseLength right after this?

[Brady Eidson]

(In reply to Alex Christensen from comment #2)
> Comment on attachment 401584 [details]
> Patch
> 
> Shouldn't we call CFDataIncreaseLength right after this?

We do (Read the whole function)

[Brady Eidson]

(In reply to Brady Eidson from comment #3)
> (In reply to Alex Christensen from comment #2)
> > Comment on attachment 401584 [details]
> > Patch
> > 
> > Shouldn't we call CFDataIncreaseLength right after this?
> 
> We do (Read the whole function)

NM - Incomplete patch uploaded.

[Brady Eidson]

Created attachment 401585 [details]
Patch

[Darin Adler]

Comment on attachment 401585 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=401585&action=review

> Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm:1628
> +        m_data = adoptCF(CFDataCreateMutable(0, 0));

Should be "nullptr, 0". But don’t have to do that in this patch.

[Brady Eidson]

(In reply to Darin Adler from comment #6)
> Comment on attachment 401585 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=401585&action=review
> 
> > Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm:1628
> > +        m_data = adoptCF(CFDataCreateMutable(0, 0));
> 
> Should be "nullptr, 0". But don’t have to do that in this patch.

A followup will actually move off CFData to NSData, per the advice of experts

[EWS]

Committed r262864: <https://trac.webkit.org/changeset/262864>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 401585 [details].