Allow multiple URL.createObjectURL invocations for MediaSource

third_party/WebKit/Source/modules/mediasource/MediaSource.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 88 matching lines @@
 
 MediaSource::MediaSource(ExecutionContext* context)
     : ActiveScriptWrappable(this)
     , ActiveDOMObject(context)
     , m_readyState(closedKeyword())
     , m_asyncEventQueue(GenericEventQueue::create(this))
     , m_attachedElement(nullptr)
     , m_sourceBuffers(SourceBufferList::create(getExecutionContext(), m_asyncEventQueue.get()))
     , m_activeSourceBuffers(SourceBufferList::create(getExecutionContext(), m_asyncEventQueue.get()))
     , m_liveSeekableRange(TimeRanges::create())
-    , m_isAddedToRegistry(false)
+    , m_addedToRegistryCounter(0)
 {
     MSLOG << __FUNCTION__ << " this=" << this;
 }
 
 MediaSource::~MediaSource()
 {
     MSLOG << __FUNCTION__ << " this=" << this;
     DCHECK(isClosed());
 }
 
@@ skipping 175 matching lines @@
     TRACE_EVENT_ASYNC_END0("media", "MediaSource::attachToElement", this);
     DCHECK(webMediaSource);
     DCHECK(!m_webMediaSource);
     DCHECK(m_attachedElement);
     m_webMediaSource = std::move(webMediaSource);
     setReadyState(openKeyword());
 }
 
 void MediaSource::addedToRegistry()
 {
-    DCHECK(!m_isAddedToRegistry);
-    m_isAddedToRegistry = true;
+    ++m_addedToRegistryCounter;

[wolenetz, 2016/07/11 18:03:17]

A web app would have to work really hard to overflow the int type here (e.g.
10,000 createObjectURL/second for about 60 hours straight), but that leaves open
the possibility for hasPendingActivity() to return false incorrectly and for
this object to be GC'ed prematurely, leading to potential use-after-free
vulnerability. Please protect against this (perhaps a simple
CHECK_GT(m_addedToRegistryCounter,0), not a DCHECK, here would suffice (after
doing the increment)).

[servolk, 2016/07/11 18:13:25]

Done.

 }
 
 void MediaSource::removedFromRegistry()
 {
-    DCHECK(m_isAddedToRegistry);
-    m_isAddedToRegistry = false;
+    DCHECK_GT(m_addedToRegistryCounter, 0);
+    --m_addedToRegistryCounter;
 }
 
 double MediaSource::duration() const
 {
     return isClosed() ? std::numeric_limits<float>::quiet_NaN() : m_webMediaSource->duration();
 }
 
 TimeRanges* MediaSource::buffered() const
 {
     // Implements MediaSource algorithm for HTMLMediaElement.buffered.
@@ skipping 318 matching lines @@
         return;
 
     setReadyState(openKeyword());
     m_webMediaSource->unmarkEndOfStream();
 }
 
 bool MediaSource::hasPendingActivity() const
 {
     return m_attachedElement || m_webMediaSource
         || m_asyncEventQueue->hasPendingEvents()
-        || m_isAddedToRegistry;
+        || m_addedToRegistryCounter > 0;
 }
 
 void MediaSource::stop()
 {
     m_asyncEventQueue->close();
     if (!isClosed())
         setReadyState(closedKeyword());
     m_webMediaSource.reset();
 }
 
@@ skipping 34 matching lines @@
 
     m_asyncEventQueue->enqueueEvent(event);
 }
 
 URLRegistry& MediaSource::registry() const
 {
     return MediaSourceRegistry::registry();
 }
 
 } // namespace blink