Title: [255929] releases/WebKitGTK/webkit-2.28/Source/WebKit
- Revision
- 255929
- Author
- carlo...@webkit.org
- Date
- 2020-02-06 07:10:22 -0800 (Thu, 06 Feb 2020)
Log Message
Merge r255860 - [IPC Hardening] Protect against targetId String being invalid in WebPageProxy::createInspectorTarget() / destroyInspectorTarget()
https://bugs.webkit.org/show_bug.cgi?id=207288
<rdar://problem/57645953>
Reviewed by Geoffrey Garen.
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::createInspectorTarget):
(WebKit::WebPageProxy::destroyInspectorTarget):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.28/Source/WebKit/ChangeLog (255928 => 255929)
--- releases/WebKitGTK/webkit-2.28/Source/WebKit/ChangeLog 2020-02-06 15:10:19 UTC (rev 255928)
+++ releases/WebKitGTK/webkit-2.28/Source/WebKit/ChangeLog 2020-02-06 15:10:22 UTC (rev 255929)
@@ -1,5 +1,17 @@
2020-02-05 Chris Dumez <cdu...@apple.com>
+ [IPC Hardening] Protect against targetId String being invalid in WebPageProxy::createInspectorTarget() / destroyInspectorTarget()
+ https://bugs.webkit.org/show_bug.cgi?id=207288
+ <rdar://problem/57645953>
+
+ Reviewed by Geoffrey Garen.
+
+ * UIProcess/WebPageProxy.cpp:
+ (WebKit::WebPageProxy::createInspectorTarget):
+ (WebKit::WebPageProxy::destroyInspectorTarget):
+
+2020-02-05 Chris Dumez <cdu...@apple.com>
+
[IPC hardening] Protect against m_inspectorPage being null inWebInspectorProxy::attach()
https://bugs.webkit.org/show_bug.cgi?id=207289
<rdar://problem/58419789>
Modified: releases/WebKitGTK/webkit-2.28/Source/WebKit/UIProcess/WebPageProxy.cpp (255928 => 255929)
--- releases/WebKitGTK/webkit-2.28/Source/WebKit/UIProcess/WebPageProxy.cpp 2020-02-06 15:10:19 UTC (rev 255928)
+++ releases/WebKitGTK/webkit-2.28/Source/WebKit/UIProcess/WebPageProxy.cpp 2020-02-06 15:10:22 UTC (rev 255929)
@@ -1683,11 +1683,13 @@
void WebPageProxy::createInspectorTarget(const String& targetId, Inspector::InspectorTargetType type)
{
+ MESSAGE_CHECK(m_process, !targetId.isEmpty());
m_inspectorController->createInspectorTarget(targetId, type);
}
void WebPageProxy::destroyInspectorTarget(const String& targetId)
{
+ MESSAGE_CHECK(m_process, !targetId.isEmpty());
m_inspectorController->destroyInspectorTarget(targetId);
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
