Branch: refs/heads/main Home: https://github.com/WebKit/WebKit Commit: 04f0e806cbcad334e1294304efb26d3be8120abd https://github.com/WebKit/WebKit/commit/04f0e806cbcad334e1294304efb26d3be8120abd Author: Andres Gonzalez <andresg...@apple.com> Date: 2023-11-09 (Thu, 09 Nov 2023)
Changed paths: M Source/WebCore/accessibility/AXObjectCache.cpp Log Message: ----------- AX: Heap-use-after-free in WebCore::AXObjectCache::get(WebCore::Node*)+0x41c rdar://113770369 Reviewed by Ryosuke Niwa. This UAF is most likely caused by a mutation in the WeakListHashSet while iterating over it. This patch avoids the problem by copying the set to a Vector and iterating over the Vector. The same technique is applied to another iteration over a WeakListHashsSet, m_deferredNodeAddedOrRemovedList, in the same method. * Source/WebCore/accessibility/AXObjectCache.cpp: (WebCore::AXObjectCache::performDeferredCacheUpdate): Originally-landed-as: 0f4469003671. rdar://117810598 Canonical link: https://commits.webkit.org/270478@main _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes