← WebKit — 2026-W36
63fcf3b9df30c3b630bbd77a849369036faeb4da Heap UAF in RTCDataChannelRemoteManager::m_sources HashMap raced between WorkQueue sendData reader and main-thread connectToRemoteSource
severity medium
class Race
confidence 0.65
signal score 11.42
Source/WebKit/WebProcess
patch-now
Primitive: Unsynchronized m_sources/m_handlers maps and raw-pointer source handle
Triage note: RC_REMOVE_SEC_ACCEL_3-gated change adds Lock m_mapsLock guarding m_sources/m_handlers (accessed from the WorkQueue and main thread) and returns RefPtr<RTCDataChannelRemoteSource> instead of a raw pointer. Fixes a cross-thread data race / UAF on the RTC data-channel maps.
Triage note: RC_REMOVE_SEC_ACCEL_3-gated change adds Lock m_mapsLock guarding m_sources/m_handlers (accessed from the WorkQueue and main thread) and returns RefPtr<RTCDataChannelRemoteSource> instead of a raw pointer. Fixes a cross-thread data race / UAF on the RTC data-channel maps.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.95), msg_strong (+3.0)
Commit message
Heap UAF in RTCDataChannelRemoteManager::m_sources HashMap raced between WorkQueue sendData reader and main-thread connectToRemoteSource
https://bugs.webkit.org/show_bug.cgi?id=323080
rdar://183834378
Reviewed by Jer Noble.
Add a lock for sources and handlers so that they can be accessed from either main thread or dedicated work queue..
* Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.cpp:
(WebKit::RTCDataChannelRemoteManager::connectToRemoteSource):
(WebKit::RTCDataChannelRemoteManager::postTaskToHandler):
(WebKit::RTCDataChannelRemoteManager::sourceFromIdentifier):
(WebKit::RTCDataChannelRemoteManager::RemoteHandlerConnection::connectToSource):
* Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.h:
Identifier: 316606.586@safari-7625-branch
Before / after
Loading diff…
On This Page