Bug 2017002 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
See the following code in [widget/cocoa/nsMacSharingService.mm](https://github.com/mozilla-firefox/firefox/blob/main/widget/cocoa/nsMacSharingService.mm):

```
    // Pass ownership of shareActivity to shareDelegate, which will release the
    // activity once sharing has completed.
    SharingServiceDelegate* shareDelegate =
        [[SharingServiceDelegate alloc] initWithActivity:shareActivity];
    [shareActivity release];

    [service setDelegate:shareDelegate];
    [shareDelegate release];
```
The comment is incorrect - the delegate reference is weak:

`@property (weak) id<NSSharingServiceDelegate> delegate;`

The delegate is allocated, set as the delegate (weak reference), then released. Anything the service does with the delegate will be a UAF.
Revision 1 by
on 
See the following code in [widget/cocoa/nsMacSharingService.mm](https://github.com/mozilla-firefox/firefox/blob/main/widget/cocoa/nsMacSharingService.mm):

```
    SharingServiceDelegate* shareDelegate =
        [[SharingServiceDelegate alloc] initWithActivity:shareActivity];
    ...
    [service setDelegate:shareDelegate];
    [shareDelegate release];
```
The setDelegate: reference is weak:

`@property (weak) id<NSSharingServiceDelegate> delegate;`

The delegate is allocated, set as the delegate (weak reference), then released. Anything the service does with the delegate will be a UAF.

Back to Bug 2017002 Comment 0