Heap-use-after-free in WebKit::MainThreadFileSystemCallbacks

https://bugs.webkit.org/show_bug.cgi?id=87019

Reviewed by David Levin.

Should not access the CallbacksBridge's member field after it's freed.

* src/WorkerFileSystemCallbacksBridge.cpp:
(WebKit::WorkerFileSystemCallbacksBridge::cleanUpAfterCallback):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121160 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index 3cbb2e8..7a8ce6f 100644 (file)
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,15 @@
+2012-06-25  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Heap-use-after-free in WebKit::MainThreadFileSystemCallbacks
+        https://bugs.webkit.org/show_bug.cgi?id=87019
+
+        Reviewed by David Levin.
+
+        Should not access the CallbacksBridge's member field after it's freed.
+
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (WebKit::WorkerFileSystemCallbacksBridge::cleanUpAfterCallback):
+
 2012-06-24  Luke Macpherson  <macpherson@chromium.org>
 
         Add runtime flag to enable/disable CSS variables (in addition to existing compile-time flag).

diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
index e87b5aa..bd9b176 100644 (file)
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
@@ -187,8 +187,10 @@ void WorkerFileSystemCallbacksBridge::cleanUpAfterCallback()
 
     m_callbacksOnWorkerThread = 0;
     if (m_workerContextObserver) {
-        delete m_workerContextObserver;
+        WorkerFileSystemContextObserver* observer = m_workerContextObserver;
         m_workerContextObserver = 0;
+        // The next line may delete this.
+        delete observer;
     }
 }