Network Cache: Crash in WebCore::CachedResource::tryReplaceEncodedData

https://bugs.webkit.org/show_bug.cgi?id=143562

Reviewed by Anders Carlsson.

If another thread comes and truncates the file before we map it we end up with a map that crashes when accessed.

* NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm:
(WebKit::NetworkCache::IOChannel::IOChannel):

    When creating a new file unlink any existing file instead of using O_TRUNC.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@182602 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index d5d0ec0ba14f92ffa91698d1ac6be8813653523f..4ae7ef37492353fd0ba1e278ab316936b231894b 100644 (file)
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,17 @@
+2015-04-09  Antti Koivisto  <antti@apple.com>
+
+        Network Cache: Crash in WebCore::CachedResource::tryReplaceEncodedData
+        https://bugs.webkit.org/show_bug.cgi?id=143562
+
+        Reviewed by Anders Carlsson.
+
+        If another thread comes and truncates the file before we map it we end up with a map that crashes when accessed.
+
+        * NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm:
+        (WebKit::NetworkCache::IOChannel::IOChannel):
+
+            When creating a new file unlink any existing file instead of using O_TRUNC.
+
 2015-04-09  Csaba Osztrogonác  <ossy@webkit.org>
 
         [EFL][GTK] WebKit2's generate-forwarding-headers.pl runs too many times

diff --git a/Source/WebKit2/NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm b/Source/WebKit2/NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm
index bade20437f14c8b14f129be8089688ad50942e9b..b1629403334c67bf97c94c7fe763cf01e401c738 100644 (file)
--- a/Source/WebKit2/NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm
+++ b/Source/WebKit2/NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm
@@ -43,12 +43,15 @@ IOChannel::IOChannel(const String& filePath, Type type)
     : m_path(filePath)
     , m_type(type)
 {
+    auto path = WebCore::fileSystemRepresentation(filePath);
     int oflag;
     mode_t mode;
 
     switch (m_type) {
     case Type::Create:
-        oflag = O_RDWR | O_CREAT | O_TRUNC | O_NONBLOCK;
+        // We don't want to truncate any existing file (with O_TRUNC) as another thread might be mapping it.
+        unlink(path.data());
+        oflag = O_RDWR | O_CREAT | O_NONBLOCK;
         mode = S_IRUSR | S_IWUSR;
         break;
     case Type::Write:
@@ -60,7 +63,6 @@ IOChannel::IOChannel(const String& filePath, Type type)
         mode = 0;
     }
 
-    CString path = WebCore::fileSystemRepresentation(filePath);
     int fd = ::open(path.data(), oflag, mode);
     m_fileDescriptor = fd;