Bug 206018 - TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString
Summary: TestController::platformLibraryPathForTesting() returns inner pointer to auto...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Tools / Tests (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Kilzer (:ddkilzer)
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-01-09 11:03 PST by David Kilzer (:ddkilzer)
Modified: 2020-01-09 18:10 PST (History)
4 users (show)

See Also:

Attachments
Patch v1 (3.43 KB, patch)
2020-01-09 12:09 PST, David Kilzer (:ddkilzer) 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Kilzer (:ddkilzer) 2020-01-09 11:03:15 PST 
TestController::platformLibraryPathForTesting() returns inner pointer to autoreleased NSString.

This will result in a use-after-free if the const char* pointer is accessed after the NSString object has been released.

This is not currently crashing because WTR::TestController::TestController() leaks autoreleased objects into a top-level autoreleasePool that's never cleared (which was NOT fixed by Bug 205950).
Comment 1 Radar WebKit Bug Importer 2020-01-09 11:05:06 PST 
<rdar://problem/58449733>
Comment 2 David Kilzer (:ddkilzer) 2020-01-09 12:09:49 PST 
Created attachment 387252 [details]
Patch v1
Comment 3 WebKit Commit Bot 2020-01-09 18:10:25 PST 
Comment on attachment 387252 [details]
Patch v1

Clearing flags on attachment: 387252

Committed r254318: <https://trac.webkit.org/changeset/254318>
Comment 4 WebKit Commit Bot 2020-01-09 18:10:27 PST 
All reviewed patches have been landed.  Closing bug.