← WebKit — 2026-W35
98f424e5b1b874e590cc1fa8bd0217fd53756302 Heap-use-after-free in RemoteImageDecoderAVF::m_frameImages
severity medium
class Race
confidence 0.62
signal score 13.37
Source/WebKit/WebProcess
patch-now
Primitive: unsynchronized concurrent access to m_frameImages HashMap of RefCounted image pointers
Triage note: Adds m_frameImagesLock WTF_GUARDED_BY_LOCK over m_frameImages, locking in frameImageAtIndex(), the main-run-loop add in createFrameImageAtIndex(), and clearFrameBufferCache() (take under lock, release outside). The create lambda runs via callOnMainRunLoopAndWait while accessors run on the caller thread, so the old code raced on a HashMap holding PlatformImagePtr, a UB data race that can corrupt the map / cause UAF.
Triage note: Adds m_frameImagesLock WTF_GUARDED_BY_LOCK over m_frameImages, locking in frameImageAtIndex(), the main-run-loop add in createFrameImageAtIndex(), and clearFrameBufferCache() (take under lock, release outside). The create lambda runs via callOnMainRunLoopAndWait while accessors run on the caller thread, so the old code raced on a HashMap holding PlatformImagePtr, a UB data race that can corrupt the map / cause UAF.
Structural signals: smartptr_member_added (+3.0), uaf_lifetime (+3.57), clamp_saturate (+1.8), msg_strong (+3.0), msg_medium (+2.0)
Commit message
Heap-use-after-free in RemoteImageDecoderAVF::m_frameImages
rdar://183770852
https://bugs.webkit.org/show_bug.cgi?id=322669
Reviewed by Youenn Fablet and Jean-Yves Avenard.
RemoteImageDecoderAVF::m_frameImages is mutated on the main thread by clearFrameBufferCache(),
and read on the image decoder work queue in createFrameImageAtIndex(), causing a UAF of the
HashMap contents.
Protect against synchronous access of the m_frameImages ivar with a lock.
Test: sar3/fast/images/animated-image-mp4-destroy-decoded-data-crash.html
* LayoutTests/sar3/fast/images/animated-image-mp4-destroy-decoded-data-crash-expected.txt: Added.
* LayoutTests/sar3/fast/images/animated-image-mp4-destroy-decoded-data-crash.html: Added.
* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVF.cpp:
(WebKit::RemoteImageDecoderAVF::frameImageAtIndex const):
(WebKit::RemoteImageDecoderAVF::createFrameImageAtIndex):
(WebKit::RemoteImageDecoderAVF::clearFrameBufferCache):
* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVF.h:
Identifier: 316606.556@safari-7625-branch
Before / after
Loading diff…
On This Page