[GLib] NetworkCache::IOChannel::read() can unlock a destroyed channel

commit message

[GLib] NetworkCache::IOChannel::read() can unlock a destroyed channel
https://bugs.webkit.org/show_bug.cgi?id=330573

Reviewed by Carlos Garcia Campos.

The read thread holds m_lock for the whole lambda but moves its
protectedThis into the completion dispatched to the caller's queue. If
that completion runs and drops the last reference before the read thread
returns, the Locker unlocks freed memory. Give the completion its own
reference, as write() already does.

* Source/WebKit/NetworkProcess/cache/NetworkCacheIOChannelGLib.cpp:
(WebKit::NetworkCache::IOChannel::read):

Canonical link: https://commits.webkit.org/326074@main

files

• Source/WebKit/NetworkProcess/cache/NetworkCacheIOChannelGLib.cpp

this commit matched a vulnerability pattern in its message. WebKit does not publish a security bug for every fix, so treat it as a lead, not as a CVE record.