Bug 315339
| Summary: | Fix heap-use-after-free in AudioVideoRendererAVFObjC::setTimeObserver when callback re-entrantly reinstalls the time observer | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Kristian Monsen <k_monsen> |
| Component: | Media | Assignee: | Jean-Yves Avenard [:jya] <jean-yves.avenard> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Kristian Monsen
Guard m_currentTimeDidChangeCallback against re-entrant replacement during its own invocation by moving it to a stack local via std::exchange, restoring it only if no new callback was installed.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Kristian Monsen
<rdar://problem/177666693>
Kristian Monsen
Pull request: https://github.com/WebKit/WebKit/pull/65456
Jean-Yves Avenard [:jya]
Pull request: https://github.com/WebKit/WebKit/pull/65463
EWS
Committed 313715@main (8c860928afff): <https://commits.webkit.org/313715@main>
Reviewed commits have been landed. Closing PR #65463 and removing active labels.