Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e388877954d173a431657d2d143692cefc4f677a
https://github.com/WebKit/WebKit/commit/e388877954d173a431657d2d143692cefc4f677a
Author: Chris Dumez <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M
Source/bmalloc/libpas/src/libpas/pas_probabilistic_guard_malloc_allocator.c
Log Message:
-----------
PGM allocator reads uninitialized free_status, misclassifying live-allocation
OOB as UAF
https://bugs.webkit.org/show_bug.cgi?id=320610
Reviewed by Yusuke Suzuki.
pas_pgm_storage is allocated via pas_utility_heap_try_allocate(), which does
not zero memory (the utility heap recycles freed blocks). The allocation path
initialized every field of the struct except free_status, which was only ever
written (to true) on the deallocation path. As a result, a still-live PGM
allocation carried a garbage free_status.
The crash reporter (pas_report_crash.c)
reads free_status to label a guard-page
fault as "UAF" versus "OOB" (and the long-range variants). For an out-of-bounds
access on a never-freed allocation -- the primary case PGM exists to detect --
free_status held uninitialized memory, so the fault could be misreported as a
use-after-free instead of an out-of-bounds access.
Initialize free_status to false on the allocation path. This is a diagnostics
fix only; it does not affect allocator control flow or memory safety.
* Source/bmalloc/libpas/src/libpas/pas_probabilistic_guard_malloc_allocator.c:
(pas_probabilistic_guard_malloc_allocate):
Canonical link:
https://flagged.apple.com:443/proxy?t2=DV8M1j4Hv7&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE4MjcyQG1haW4=&emid=63d0ba7f-404e-4dd3-89ff-d9d135c45bfc&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
