Bug 151845 - DumpRenderTree: Use-after-free in createBitmapContext() in PixelDumpSupportMac.mm
Summary: DumpRenderTree: Use-after-free in createBitmapContext() in PixelDumpSupportMa...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Tools / Tests (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Kilzer (:ddkilzer)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-03 20:24 PST by David Kilzer (:ddkilzer)
Modified: 2015-12-03 21:25 PST (History)
6 users (show)

See Also:


Attachments
Patch v1 (2.51 KB, patch)
2015-12-03 20:27 PST, David Kilzer (:ddkilzer)
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description David Kilzer (:ddkilzer) 2015-12-03 20:24:31 PST
The clang static analyzer found the following issue:

DumpRenderTree/mac/PixelDumpSupportMac.mm:67:9: warning: Use of memory after it is freed
        WTFLogAlways("DumpRenderTree: CGBitmapContextCreate(%p, %llu, %llu, 8, %llu, %p, 0x%x) failed\n", buffer, pixelsHigh, pixelsWide, rowBytes, colorSpace.get(), kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The issue is that free(buffer) is called before it's used in the WTFLogAlways() macro:

    if (!context) {
        free(buffer);
        WTFLogAlways("DumpRenderTree: CGBitmapContextCreate(%p, %llu, %llu, 8, %llu, %p, 0x%x) failed\n", buffer, pixelsHigh, pixelsWide, rowBytes, colorSpace.get(), kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host);
        return nullptr;
    }
Comment 1 David Kilzer (:ddkilzer) 2015-12-03 20:27:47 PST
Created attachment 266591 [details]
Patch v1
Comment 2 Simon Fraser (smfr) 2015-12-03 20:37:09 PST
Comment on attachment 266591 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=266591&action=review

> Tools/DumpRenderTree/mac/PixelDumpSupportMac.mm:66
>          WTFLogAlways("DumpRenderTree: CGBitmapContextCreate(%p, %llu, %llu, 8, %llu, %p, 0x%x) failed\n", buffer, pixelsHigh, pixelsWide, rowBytes, colorSpace.get(), kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host);

This just prints the address of the buffer, so not really a use-after-free. But OK.
Comment 3 David Kilzer (:ddkilzer) 2015-12-03 20:44:58 PST
(In reply to comment #2)
> Comment on attachment 266591 [details]
> Patch v1
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=266591&action=review
> 
> > Tools/DumpRenderTree/mac/PixelDumpSupportMac.mm:66
> >          WTFLogAlways("DumpRenderTree: CGBitmapContextCreate(%p, %llu, %llu, 8, %llu, %p, 0x%x) failed\n", buffer, pixelsHigh, pixelsWide, rowBytes, colorSpace.get(), kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host);
> 
> This just prints the address of the buffer, so not really a use-after-free.
> But OK.

I know.  It's the lamest use-after-free ever.
Comment 4 WebKit Commit Bot 2015-12-03 21:25:02 PST
Comment on attachment 266591 [details]
Patch v1

Clearing flags on attachment: 266591

Committed r193409: <http://trac.webkit.org/changeset/193409>
Comment 5 WebKit Commit Bot 2015-12-03 21:25:04 PST
All reviewed patches have been landed.  Closing bug.