Bug 264119
| Summary: | [GStreamer] MediaPlayerPrivateGStreamer stores refcounted AudioSourceProviderGStreamer in a std::unique_ptr | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Michael Catanzaro <mcatanzaro> |
| Component: | Media | Assignee: | Michael Catanzaro <mcatanzaro> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bfulgham, bugs-noreply, mcatanzaro, philn, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| See Also: |
https://bugs.webkit.org/show_bug.cgi?id=261280 https://bugs.webkit.org/show_bug.cgi?id=261224 |
||
Michael Catanzaro
The static assertion added in bug #261280 reveals that MediaPlayerPrivateGStreamer stores AudioSourceProviderGStreamer in a std::unique_ptr. This is unsafe because AudioSourceProviderGStreamer is refcounted and should not be deleted while a ref is outstanding.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/117881093>
Michael Catanzaro
This is a security bug, but the flaw is public on the 2.42 branch already since I needed to fix this for the 2.42.2 release, so no point in using the security fork for a pull request. Our scripts don't allow creating public pull requests against security bugs anymore, so changing product/component accordingly.
Michael Catanzaro
Pull request: https://github.com/WebKit/WebKit/pull/19920
EWS
Committed 270266@main (0f803ec2d5e6): <https://commits.webkit.org/270266@main>
Reviewed commits have been landed. Closing PR #19920 and removing active labels.