Skip to content
  • ap@apple.com's avatar
    <rdar://problem/12834449> Crashes in WebSocketChannel::processFrame when processing a ping · 9729b33f
    ap@apple.com authored
            https://bugs.webkit.org/show_bug.cgi?id=114178
    
            Reviewed by Brady Eidson.
    
            No test, I could never reproduce even manually.
    
            Calling enqueueRawFrame() could change incoming buffer, so a subsequent skipBuffer()
            would operate on wrong assumptions. This happened because enqueueRawFrame() actually
            tried to process the queue, and send failure sometimed clears m_buffer.
    
            Fixing this by decoupling enqueuing from sending, and making sure that skipBuffer()
            in ping frame processing case is performed at a safe time.
    
            * Modules/websockets/WebSocketChannel.cpp:
            (WebCore::WebSocketChannel::send):
            (WebCore::WebSocketChannel::startClosingHandshake):
            (WebCore::WebSocketChannel::processFrame):
            (WebCore::WebSocketChannel::enqueueTextFrame):
            (WebCore::WebSocketChannel::enqueueRawFrame):
            (WebCore::WebSocketChannel::enqueueBlobFrame):
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@147938 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    9729b33f