Skip to content

Commit

Permalink
[WebGPU] RenderBundleEncoder::setVertexBuffer may result in a UAF
Browse files Browse the repository at this point in the history
https://bugs.webkit.org/show_bug.cgi?id=274525
<radar://128537945>

Reviewed by Dan Glastonbury.

Every other call site to recordCommand captures by Ref, this
was the only outlier passing a raw C++ pointer to the lambda.

* Source/WebGPU/WebGPU/RenderBundleEncoder.mm:
(WebGPU::RenderBundleEncoder::setVertexBuffer):

Canonical link: https://commits.webkit.org/279171@main
  • Loading branch information
mwyrzykowski committed May 23, 2024
1 parent a0dd96a commit 140660a
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions Source/WebGPU/WebGPU/RenderBundleEncoder.mm
Original file line number Diff line number Diff line change
Expand Up @@ -1076,8 +1076,8 @@ - (instancetype)initWithICB:(id<MTLIndirectCommandBuffer>)icb pipelineState:(id<
}

m_requiresMetalWorkaround = false;
recordCommand([slot, optionalBuffer, offset, size, protectedThis = Ref { *this }] {
protectedThis->setVertexBuffer(slot, optionalBuffer, offset, size);
recordCommand([slot, optionalBuffer = RefPtr { optionalBuffer }, offset, size, protectedThis = Ref { *this }] {
protectedThis->setVertexBuffer(slot, optionalBuffer.get(), offset, size);
return false;
});
}
Expand Down

0 comments on commit 140660a

Please sign in to comment.