Bug 22623 – Uninitialized memory access in cache parsing code

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Dean McNamee]

http://trac.webkit.org/changeset/38145
https://bugs.webkit.org/show_bug.cgi?id=21596

This patch added two additional fields:

 	129	    mutable bool m_haveParsedCacheControlHeader:1; 
 	130	    mutable bool m_haveParsedPragmaHeader:1; 

These are not initialized anywhere.  They should likely both be set to false in the constructor above.  This is causing undefined behavior, it can lead to the code thinking we have already parsed the cache control header (and returning the already parsed value), when we actually have no parsed anything.

[Dean McNamee]

Created attachment 25707 [details]
Patch to initialize the variables in the contructors.

[David Kilzer (:ddkilzer)]

Comment on attachment 25707 [details]
Patch to initialize the variables in the contructors.

>[phone]  Dean McNamee  <[e-mail]>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Initialize m_haveParsedCacheControlHeader and m_haveParsedPragmaHeader.
>+
>+        * platform/network/ResourceResponseBase.h:
>+        (WebCore::ResourceResponseBase::ResourceResponseBase):

Please include a reference to this bug in the ChangeLog entry before landing the patch.

Otherwise, looks good.  Thanks for finding this!  r=me

[Dean McNamee]

Created attachment 25709 [details]
Added bug reference

[Dean McNamee]

Added a reference to the bug.  I don't have commit access, so if you could commit it for me that'd be great.  Thanks!

[David Kilzer (:ddkilzer)]

$ git svn dcommit
Committing to http://svn.webkit.org/repository/webkit/trunk ...
        M       WebCore/ChangeLog
        M       WebCore/platform/network/ResourceResponseBase.h
Committed r38940

[David Kilzer (:ddkilzer)]

http://trac.webkit.org/changeset/38940