Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 94c5f976f8554fe62e2a274e713c22031507a0bf
https://github.com/WebKit/WebKit/commit/94c5f976f8554fe62e2a274e713c22031507a0bf
Author: Richard Robinson <[email protected]>
Date: 2026-07-17 (Fri, 17 Jul 2026)
Changed paths:
M Source/WebKit/UIProcess/mac/PositionInformationManager.cpp
M Source/WebKit/UIProcess/mac/PositionInformationManager.h
Log Message:
-----------
[AppKit Gestures] Fix incorrect logic in
`PositionInformationManager::invokeAndRemovePendingHandlers` that could result
in a reentrancy UAF
https://bugs.webkit.org/show_bug.cgi?id=319631
rdar://182455133
Reviewed by Megan Gardner and Abrar Rahman Protyasha.
This logic was originally changed to use a range-based for loop instead of an
index-based one since
it was non-obvious that there could be functional differences between the two.
`invokeAndRemovePendingHandlers()` iterates m_pendingHandlers with a
range-based for loop, which caches
the Vector's begin/end raw pointers. The invoked callback can synchronously
re-enter doAfterUpdate()
(the design explicitly supports reentrancy via m_callbackDepth and tombstone
slots), and doAfterUpdate()
calls m_pendingHandlers.constructAndAppend(), which reallocates the backing
buffer once capacity is
exceeded. That reallocation invalidates the cached loop iterators and the live
slot reference, causing
a use-after-free read/write as the loop continues over freed memory.
Fix by restoring the index-based loop since it re-reads size() and re-indexes
each iteration to survive reallocation.
* Source/WebKit/UIProcess/mac/PositionInformationManager.cpp:
(WebKit::PositionInformationManager::invokeAndRemovePendingHandlers):
* Source/WebKit/UIProcess/mac/PositionInformationManager.h:
Canonical link: https://commits.webkit.org/317401@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
