135040 2014-07-17 23:11:24 -0700 inserting an SVGLength that is already in an SVGAnimatedLengthList::animVal into another list causes a crash 2019-05-06 12:40:15 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 191237 http://mcc.id.au/temp/list4.html P2 Normal --- 1 heycam webkit-unassigned darin krit sabouhallawa zimmermann zoltan oldest_to_newest 1023209 0 heycam 2014-07-17 23:11:24 -0700 STR: 1. Load the URL. 2. Crash. Attempting to insert an SVGLength that came from an SVGAnimatedLengthList's animVal into another SVGLengthList will cause a crash. I haven't looked to see if the crash is serious. Tested with Safari 7.0.5 (9537.77.4). 1023496 1 darin 2014-07-19 22:32:54 -0700 This crash is a null dereference; I doubt there is any security implication, and I suspect this is mis-categorized as a security bug. The bug seems to be in code in SVGListPropertyTearOff::processIncomingListItemWrapper, which calls SVGAnimatedListPropertyTearOff::findItem, which can’t handle an m_baseVal of nullptr. If I knew this code better, I might suggest fixing this by calling baseVal() inside findItem and in removeItemFromList rather than accessing m_baseVal directly. 1023504 2 krit 2014-07-19 23:23:34 -0700 (In reply to comment #1) > This crash is a null dereference; I doubt there is any security implication, and I suspect this is mis-categorized as a security bug. > > The bug seems to be in code in SVGListPropertyTearOff::processIncomingListItemWrapper, which calls SVGAnimatedListPropertyTearOff::findItem, which can’t handle an m_baseVal of nullptr. If I knew this code better, I might suggest fixing this by calling baseVal() inside findItem and in removeItemFromList rather than accessing m_baseVal directly. I asked Cameron to open it as security bug since I couldn't test it myself yet. If you have evidence that it is a normal crash, please re-categorize it. 1023507 3 darin 2014-07-19 23:30:21 -0700 OK, done. 1023508 4 235179 darin 2014-07-19 23:31:03 -0700 Created attachment 235179 local copy of test case 1023509 5 darin 2014-07-19 23:31:29 -0700 Crashes after trying to access a data member of m_baseVal, which is nullptr. 1053976 6 zoltan 2014-12-09 16:00:17 -0800 Blink doesn't have the issue, probably because of some refactoring on this code. Merge candidate tracked in: https://bugs.webkit.org/show_bug.cgi?id=125888 1533485 7 sabouhallawa 2019-05-06 12:40:15 -0700 After https://bugs.webkit.org/show_bug.cgi?id=191237 is fixed and when opening the attached test case in WebKit, I get the following output: appending an SVG item that is in an animVal list of another element: - animVal list item remained the same object - an item was appended - the appended item was a copy of the animVal list item This is complies with SVG 2 specs: https://www.w3.org/TR/SVG2/types.html#__svg__SVGNameList__appendItem. Also this is the behavior of FireFox. *** This bug has been marked as a duplicate of bug 191237 *** 235179 2014-07-19 23:31:03 -0700 2014-07-19 23:31:03 -0700 local copy of test case list4.html text/html 1311 darin PCFET0NUWVBFIGh0bWw+CjxzdHlsZT4KcHJlIHsgd2hpdGUtc3BhY2U6IHByZTsgfQo8L3N0eWxl Pgo8cHJlPjwvcHJlPgo8c2NyaXB0PgpmdW5jdGlvbiBzYXkoYU1lc3NhZ2UpIHsKICBkb2N1bWVu dC5xdWVyeVNlbGVjdG9yKCJwcmUiKS50ZXh0Q29udGVudCArPSBhTWVzc2FnZSArICJcbiI7Cn0K CnZhciB0ZXh0MSA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnROUygiaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciLCAidGV4dCIpOwoKdmFyIHRleHQyID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudE5T KCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIsICJ0ZXh0Iik7CnRleHQyLnNldEF0dHJpYnV0 ZSgieCIsICIyMCIpOwp0ZXh0Mi5zZXRBdHRyaWJ1dGUoInkiLCAiMzAiKTsKCnNheSgiYXBwZW5k aW5nIGFuIFNWRyBpdGVtIHRoYXQgaXMgaW4gYW4gYW5pbVZhbCBsaXN0IG9mIGFub3RoZXIgZWxl bWVudDoiKTsKdGV4dDEuc2V0QXR0cmlidXRlKCJ4IiwgIjEwIik7Cmxpc3QgPSB0ZXh0MS54LmJh c2VWYWw7CnZhciBhbmltVmFsSW5MaXN0ID0gdGV4dDIueS5hbmltVmFsLmdldEl0ZW0oMCk7CnRy eSB7CiAgbGlzdC5hcHBlbmRJdGVtKGFuaW1WYWxJbkxpc3QpOwogIGlmICh0ZXh0Mi55LmFuaW1W YWwuZ2V0SXRlbSgwKSA9PSBhbmltVmFsSW5MaXN0KSB7CiAgICBzYXkoIiAgLSBhbmltVmFsIGxp c3QgaXRlbSByZW1haW5lZCB0aGUgc2FtZSBvYmplY3QiKTsKICB9IGVsc2UgaWYgKCF0ZXh0Mi55 LmFuaW1WYWwuZ2V0SXRlbSgwKSkgewogICAgc2F5KCIgIC0gYW5pbVZhbCBsaXN0IGl0ZW0gd2Fz IHJlbW92ZWQgZnJvbSBpdHMgb3JpZ2luYWwgbGlzdCIpOwogIH0gZWxzZSB7CiAgICBzYXkoIiAg LSBhbmltVmFsIGxpc3QgaXRlbSBvYmplY3Qgd2FzIGNoYW5nZWQiKTsKICB9CiAgaWYgKGxpc3Qu Z2V0SXRlbSgxKSkgewogICAgc2F5KCIgIC0gYW4gaXRlbSB3YXMgYXBwZW5kZWQiKTsKICAgIGlm IChsaXN0LmdldEl0ZW0oMSkgPT0gYW5pbVZhbEluTGlzdCkgewogICAgICBzYXkoIiAgLSB0aGUg YXBwZW5kZWQgaXRlbSB3YXMgdGhlIGFuaW1WYWwgbGlzdCBpdGVtIG9iamVjdCIpOwogICAgfSBl bHNlIHsKICAgICAgc2F5KCIgIC0gdGhlIGFwcGVuZGVkIGl0ZW0gd2FzIGEgY29weSBvZiB0aGUg YW5pbVZhbCBsaXN0IGl0ZW0iKTsKICAgIH0KICB9IGVsc2UgewogICAgc2F5KCIgIC0gdGhlIGFw cGVuZEl0ZW0gY2FsbCB3YXMgc2lsZW50bHkgaWdub3JlZCIpOwogIH0KfSBjYXRjaCAoZXgpIHsK ICBzYXkoIiAgLSBhbiBleGNlcHRpb24gd2FzIHRocm93bjogIiArIGV4KTsKfQo8L3NjcmlwdD4K