Bug 284408 – OOB crash under WebKit::dataProviderGetBytesAtPositionCallback during off-main-thread incremental PDF loading

• Status: RESOLVED
• Resolution: FIXED
• Component: PDF

[Abrar Rahman Protyasha]

rdar://131110151

[Abrar Rahman Protyasha]

Representative crash:

```
Thread 4 Crashed::   Dispatch queue: LinearizedPagePreload
0 _platform_memmove + 96
1 void WTF::memcpySpan<unsigned char, 18446744073709551615ul, unsigned char const, 18446744073709551615ul>(std::__1::span<unsigned char, 18446744073709551615ul>, std::__1::span<unsigned char const, 18446744073709551615ul>) + 16
2 WebKit::PDFIncrementalLoader::dataProviderGetBytesAtPosition(std::__1::span<unsigned char, 18446744073709551615ul>, long long) + 52
3 WebKit::dataProviderGetBytesAtPositionCallback(void*, void*, long long, unsigned long) + 308
4 provider_get_bytes_at_position + 84
5 CGDataProviderDirectGetBytesAtPositionInternal + 308
```

My current leading hypothesis is that the source buffer for the memcpy is nulled out before using it but after fetching it from the plugin. We should guard this work behind the data lock used for the buffer, too.

[Abrar Rahman Protyasha]

Pull request: https://github.com/apple/WebKit/pull/2388

[EWS]

Committed 283286.578@safari-7620-branch (de6e83ab1f4d): <https://commits.webkit.org/283286.578@safari-7620-branch>

Reviewed commits have been landed. Closing PR #2388 and removing active labels.

[Jonathan Bedard]

<rdar://problem/141548517>

[Jonathan Bedard]

Re-opening for pull request https://github.com/apple/WebKit/pull/2406

[EWS]

Committed 283286.595@safari-7620-branch (0053acf9bc55): <https://commits.webkit.org/283286.595@safari-7620-branch>

Reviewed commits have been landed. Closing PR #2406 and removing active labels.

[Robert Jenner]

<rdar://problem/143592990>

[EWS]

Committed 289647@main (1c283c67a9c0): <https://commits.webkit.org/289647@main>

Reviewed commits have been landed. Closing PR #39706 and removing active labels.