Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(33)

Side by Side Diff: Source/core/loader/DocumentLoader.h

Issue 1263363005: Better handle reentrancy into DocumentLoader::dataReceived(). (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Fix UaF Created 5 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « no previous file | Source/core/loader/DocumentLoader.cpp » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved. 2 * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
3 * Copyright (C) 2011 Google Inc. All rights reserved. 3 * Copyright (C) 2011 Google Inc. All rights reserved.
4 * 4 *
5 * Redistribution and use in source and binary forms, with or without 5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions 6 * modification, are permitted provided that the following conditions
7 * are met: 7 * are met:
8 * 8 *
9 * 1. Redistributions of source code must retain the above copyright 9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer. 10 * notice, this list of conditions and the following disclaimer.
(...skipping 24 matching lines...) Expand all
35 #include "core/fetch/ClientHintsPreferences.h" 35 #include "core/fetch/ClientHintsPreferences.h"
36 #include "core/fetch/RawResource.h" 36 #include "core/fetch/RawResource.h"
37 #include "core/fetch/ResourceLoaderOptions.h" 37 #include "core/fetch/ResourceLoaderOptions.h"
38 #include "core/fetch/ResourcePtr.h" 38 #include "core/fetch/ResourcePtr.h"
39 #include "core/fetch/SubstituteData.h" 39 #include "core/fetch/SubstituteData.h"
40 #include "core/frame/csp/ContentSecurityPolicy.h" 40 #include "core/frame/csp/ContentSecurityPolicy.h"
41 #include "core/loader/DocumentLoadTiming.h" 41 #include "core/loader/DocumentLoadTiming.h"
42 #include "core/loader/DocumentWriter.h" 42 #include "core/loader/DocumentWriter.h"
43 #include "core/loader/FrameLoaderTypes.h" 43 #include "core/loader/FrameLoaderTypes.h"
44 #include "core/loader/NavigationPolicy.h" 44 #include "core/loader/NavigationPolicy.h"
45 #include "platform/SharedBuffer.h"
45 #include "platform/network/ResourceError.h" 46 #include "platform/network/ResourceError.h"
46 #include "platform/network/ResourceRequest.h" 47 #include "platform/network/ResourceRequest.h"
47 #include "platform/network/ResourceResponse.h" 48 #include "platform/network/ResourceResponse.h"
48 #include "wtf/HashSet.h" 49 #include "wtf/HashSet.h"
49 #include "wtf/RefPtr.h" 50 #include "wtf/RefPtr.h"
50 51
51 namespace blink { 52 namespace blink {
52 53
53 class ApplicationCacheHost; 54 class ApplicationCacheHost;
54 class ResourceFetcher; 55 class ResourceFetcher;
(...skipping 115 matching lines...) Expand 10 before | Expand all | Expand 10 after
170 void prepareSubframeArchiveLoadIfNeeded(); 171 void prepareSubframeArchiveLoadIfNeeded();
171 172
172 void willSendRequest(ResourceRequest&, const ResourceResponse&); 173 void willSendRequest(ResourceRequest&, const ResourceResponse&);
173 void finishedLoading(double finishTime); 174 void finishedLoading(double finishTime);
174 void mainReceivedError(const ResourceError&); 175 void mainReceivedError(const ResourceError&);
175 void cancelLoadAfterXFrameOptionsOrCSPDenied(const ResourceResponse&); 176 void cancelLoadAfterXFrameOptionsOrCSPDenied(const ResourceResponse&);
176 void redirectReceived(Resource*, ResourceRequest&, const ResourceResponse&) final; 177 void redirectReceived(Resource*, ResourceRequest&, const ResourceResponse&) final;
177 void updateRequest(Resource*, const ResourceRequest&) final; 178 void updateRequest(Resource*, const ResourceRequest&) final;
178 void responseReceived(Resource*, const ResourceResponse&, PassOwnPtr<WebData ConsumerHandle>) final; 179 void responseReceived(Resource*, const ResourceResponse&, PassOwnPtr<WebData ConsumerHandle>) final;
179 void dataReceived(Resource*, const char* data, unsigned length) final; 180 void dataReceived(Resource*, const char* data, unsigned length) final;
181 void processData(const char* data, unsigned length);
180 void notifyFinished(Resource*) final; 182 void notifyFinished(Resource*) final;
181 183
182 bool maybeLoadEmpty(); 184 bool maybeLoadEmpty();
183 185
184 bool isRedirectAfterPost(const ResourceRequest&, const ResourceResponse&); 186 bool isRedirectAfterPost(const ResourceRequest&, const ResourceResponse&);
185 187
186 bool shouldContinueForResponse() const; 188 bool shouldContinueForResponse() const;
187 189
188 RawPtrWillBeMember<LocalFrame> m_frame; 190 RawPtrWillBeMember<LocalFrame> m_frame;
189 PersistentWillBeMember<ResourceFetcher> m_fetcher; 191 PersistentWillBeMember<ResourceFetcher> m_fetcher;
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after
226 InitialScrollState m_initialScrollState; 228 InitialScrollState m_initialScrollState;
227 229
228 enum State { 230 enum State {
229 NotStarted, 231 NotStarted,
230 Provisional, 232 Provisional,
231 Committed, 233 Committed,
232 DataReceived, 234 DataReceived,
233 MainResourceDone 235 MainResourceDone
234 }; 236 };
235 State m_state; 237 State m_state;
238
239 // Used to protect against reentrancy into dataReceived().
240 bool m_inDataReceived;
241 RefPtr<SharedBuffer> m_dataBuffer;
236 }; 242 };
237 243
238 DECLARE_WEAK_IDENTIFIER_MAP(DocumentLoader); 244 DECLARE_WEAK_IDENTIFIER_MAP(DocumentLoader);
239 245
240 } // namespace blink 246 } // namespace blink
241 247
242 #endif // DocumentLoader_h 248 #endif // DocumentLoader_h
OLDNEW
« no previous file with comments | « no previous file | Source/core/loader/DocumentLoader.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698