Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1334)

Unified Diff: Source/core/loader/DocumentLoader.h

Issue 1263363005: Better handle reentrancy into DocumentLoader::dataReceived(). (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Fix UaF Created 5 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | Source/core/loader/DocumentLoader.cpp » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/core/loader/DocumentLoader.h
diff --git a/Source/core/loader/DocumentLoader.h b/Source/core/loader/DocumentLoader.h
index c11c3d0f9ea6392b0c99027618474cb2059b753a..6a5bafc6740ccaac4fc6f078c097dd3e56293f8b 100644
--- a/Source/core/loader/DocumentLoader.h
+++ b/Source/core/loader/DocumentLoader.h
@@ -42,6 +42,7 @@
#include "core/loader/DocumentWriter.h"
#include "core/loader/FrameLoaderTypes.h"
#include "core/loader/NavigationPolicy.h"
+#include "platform/SharedBuffer.h"
#include "platform/network/ResourceError.h"
#include "platform/network/ResourceRequest.h"
#include "platform/network/ResourceResponse.h"
@@ -177,6 +178,7 @@ private:
void updateRequest(Resource*, const ResourceRequest&) final;
void responseReceived(Resource*, const ResourceResponse&, PassOwnPtr<WebDataConsumerHandle>) final;
void dataReceived(Resource*, const char* data, unsigned length) final;
+ void processData(const char* data, unsigned length);
void notifyFinished(Resource*) final;
bool maybeLoadEmpty();
@@ -233,6 +235,10 @@ private:
MainResourceDone
};
State m_state;
+
+ // Used to protect against reentrancy into dataReceived().
+ bool m_inDataReceived;
+ RefPtr<SharedBuffer> m_dataBuffer;
};
DECLARE_WEAK_IDENTIFIER_MAP(DocumentLoader);
« no previous file with comments | « no previous file | Source/core/loader/DocumentLoader.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698