139506 2014-12-10 14:13:43 -0800 Null dereference performing a "TapAndAHalf" gesture in Google search field 2014-12-10 17:09:24 -0800 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED http://google.com InRadar P2 Normal --- 1 jhoneycutt jhoneycutt enrica simon.fraser oldest_to_newest 1054298 0 jhoneycutt 2014-12-10 14:13:43 -0800 A null dereference can occur when performing a "TapAndAHalf" gesture in the Google search field. Repro test case: data:text/html,<input%20size="40"%20%20placeholder="Perform%20a%20tap%20and%20a%20half%20gesture%20in%20this%20field"> <rdar://problem/19028828> 1054301 1 243066 jhoneycutt 2014-12-10 14:26:22 -0800 Created attachment 243066 Patch 1054345 2 243066 darin 2014-12-10 16:56:28 -0800 Comment on attachment 243066 Patch This change seems OK, but just a few lines later I see code that calls Range::create and dereferences the result unconditionally. I think we should consistently handle null in both places in this function instead of just in this one place. 1054347 3 jhoneycutt 2014-12-10 17:05:05 -0800 (In reply to comment #2) > Comment on attachment 243066 [details] > Patch > > This change seems OK, but just a few lines later I see code that calls > Range::create and dereferences the result unconditionally. I think we should > consistently handle null in both places in this function instead of just in > this one place. This adds a null check for the result of wordRangeFromPosition before calling Range::create. Range::create doesn't return null. Thanks for the review! 1054351 4 jhoneycutt 2014-12-10 17:09:24 -0800 Committed r177115: <http://trac.webkit.org/changeset/177115> 243066 2014-12-10 14:26:22 -0800 2014-12-10 16:56:28 -0800 Patch bug-139506-20141210142703.patch text/plain 3101 jhoneycutt U3VidmVyc2lvbiBSZXZpc2lvbjogMTc3MDEzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXggM2I0ZTc5OWI0NzQ5MGYz MzEwYzU4NDJmMzA1NjJhYWY1MmM5YTQ3OS4uNTBlM2E3MDZhNDY4MjhhNDhjNWZkMTY3MzM5ZDcx MTNjYTBjYzA4OSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE0LTEyLTA5ICBKb24g SG9uZXljdXR0ICA8amhvbmV5Y3V0dEBhcHBsZS5jb20+CisKKyAgICAgICAgTnVsbCBkZXJlZmVy ZW5jZSBwZXJmb3JtaW5nIGEgIlRhcEFuZEFIYWxmIiBnZXN0dXJlIGluIEdvb2dsZSBzZWFyY2gg ZmllbGQKKworICAgICAgICA8aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTEzOTUwNj4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzE5MDI4ODI4PgorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogV2ViUHJvY2Vzcy9XZWJQYWdl L2lvcy9XZWJQYWdlSU9TLm1tOgorICAgICAgICAoV2ViS2l0OjpXZWJQYWdlOjpzZWxlY3RXaXRo R2VzdHVyZSk6CisgICAgICAgIEFkZCBhIG51bGwgY2hlY2sgaW4gdGhlIGNhc2UgdGhhdCB0aGVy ZSBpcyBubyB3b3JkIHJhbmdlIGZvciB0aGUKKyAgICAgICAgY3VycmVudCBwb3NpdGlvbi4KKwog MjAxNC0xMi0wOSAgSmVyZW15IEpvbmVzICA8amVyZW15akBhcHBsZS5jb20+CiAKICAgICAgICAg RW5hYmxlIGFjdGl2YXRpbmcgb3B0aW1pemVkIGZ1bGxzY3JlZW4gbW9kZSBmcm9tIHN0YW5kYXJk IGZ1bHNjcmVlbiBtb2RlLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9X ZWJQYWdlL2lvcy9XZWJQYWdlSU9TLm1tIGIvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQ YWdlL2lvcy9XZWJQYWdlSU9TLm1tCmluZGV4IGNkYjI1NmNhODcyNWIxNmExN2E2MDYxY2NkMGU4 NDU0MDlmYTk1ODYuLjQ1MjZmYzg3ODdlZWY4ZDRhODQxYTIwNDJkZWNiYzI5Zjg2NmY5N2QgMTAw NjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9pb3MvV2ViUGFnZUlP Uy5tbQorKysgYi9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1dlYlBhZ2UvaW9zL1dlYlBhZ2VJ T1MubW0KQEAgLTg4OSw3ICs4ODksNyBAQCB2b2lkIFdlYlBhZ2U6OnNlbGVjdFdpdGhHZXN0dXJl KGNvbnN0IEludFBvaW50JiBwb2ludCwgdWludDMyX3QgZ3JhbnVsYXJpdHksIHVpbgogICAgICAg ICBzd2l0Y2ggKHdrR2VzdHVyZVN0YXRlKSB7CiAgICAgICAgIGNhc2UgR2VzdHVyZVJlY29nbml6 ZXJTdGF0ZTo6QmVnYW46CiAgICAgICAgICAgICByYW5nZSA9IHdvcmRSYW5nZUZyb21Qb3NpdGlv bihwb3NpdGlvbik7Ci0gICAgICAgICAgICBtX2N1cnJlbnRXb3JkUmFuZ2UgPSBSYW5nZTo6Y3Jl YXRlKCpmcmFtZS5kb2N1bWVudCgpLCByYW5nZS0+c3RhcnRQb3NpdGlvbigpLCByYW5nZS0+ZW5k UG9zaXRpb24oKSk7CisgICAgICAgICAgICBtX2N1cnJlbnRXb3JkUmFuZ2UgPSByYW5nZSA/IFJh bmdlOjpjcmVhdGUoKmZyYW1lLmRvY3VtZW50KCksIHJhbmdlLT5zdGFydFBvc2l0aW9uKCksIHJh bmdlLT5lbmRQb3NpdGlvbigpKSA6IG51bGxwdHI7CiAgICAgICAgICAgICBicmVhazsKICAgICAg ICAgY2FzZSBHZXN0dXJlUmVjb2duaXplclN0YXRlOjpDaGFuZ2VkOgogICAgICAgICAgICAgaWYg KCFtX2N1cnJlbnRXb3JkUmFuZ2UpCmRpZmYgLS1naXQgYS9DaGFuZ2VMb2cgYi9DaGFuZ2VMb2cK aW5kZXggN2QwMDg0ODFkZGRmMmZiYjdhOTRmNGQ0YjI2YmZjMDFiNmNlMjdmYi4uMGY3MzcyYTNh MDAxYWE5NjM1OGU4MDVmM2UyNjdjMDQ2OTFmNjVhMyAxMDA2NDQKLS0tIGEvQ2hhbmdlTG9nCisr KyBiL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDE0LTEyLTEwICBKb24gSG9uZXljdXR0 ICA8amhvbmV5Y3V0dEBhcHBsZS5jb20+CisKKyAgICAgICAgTnVsbCBkZXJlZmVyZW5jZSBwZXJm b3JtaW5nIGEgIlRhcEFuZEFIYWxmIiBnZXN0dXJlIGluIEdvb2dsZSBzZWFyY2ggZmllbGQKKwor ICAgICAgICA8aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzOTUwNj4K KyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzE5MDI4ODI4PgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogTWFudWFsVGVzdHMvaW9zL3RhcC1hbmQtYS1o YWxmLWdlc3R1cmUtaW4tZW1wdHktdGV4dC1maWVsZC5odG1sOiBBZGRlZC4KKwogMjAxNC0xMi0w NyAgQWxiZXJ0byBHYXJjaWEgIDxiZXJ0b0BpZ2FsaWEuY29tPgogCiAgICAgICAgIFtHVEtdIFdl YktpdCBoYXMgYSBuZXcgcmVxdWlyZWQgZGVwZW5kZW5jeSBvbiBHbnVUTFMKZGlmZiAtLWdpdCBh L01hbnVhbFRlc3RzL2lvcy90YXAtYW5kLWEtaGFsZi1nZXN0dXJlLWluLWVtcHR5LXRleHQtZmll bGQuaHRtbCBiL01hbnVhbFRlc3RzL2lvcy90YXAtYW5kLWEtaGFsZi1nZXN0dXJlLWluLWVtcHR5 LXRleHQtZmllbGQuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi42ZTJkZjhiZmEyYjY0ZmY0Zjg1YTVjNGI0YjNi Y2MxNzNlZmIyMDcwCi0tLSAvZGV2L251bGwKKysrIGIvTWFudWFsVGVzdHMvaW9zL3RhcC1hbmQt YS1oYWxmLWdlc3R1cmUtaW4tZW1wdHktdGV4dC1maWVsZC5odG1sCkBAIC0wLDAgKzEsNiBAQAor VGhpcyB0ZXN0cyB0aGF0IHBlcmZvcm1pbmcgYSB0YXAgYW5kIGEgaGFsZiBnZXN0dXJlIGluIGEg dGV4dCBmaWVsZCB3aXRoIG5vIG5lYXJieSB0ZXh0IGRvZXMgbm90IGNyYXNoLgorV2ViS2l0IGJ1 ZyAjPGEgaHJlZj0iaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzOTUw NiI+MTM5NTA2PC9hPi4KKworPGJyPjxicj4KKworPGlucHV0IHNpemU9IjQwIiBwbGFjZWhvbGRl cj0iUGVyZm9ybSBhIHRhcCBhbmQgYSBoYWxmIGdlc3R1cmUgaW4gdGhpcyBmaWVsZCI+ClwgTm8g bmV3bGluZSBhdCBlbmQgb2YgZmlsZQo=