143144 2015-03-27 12:45:02 -0700 Null dereference in InbandMetadataTextTrack handling 2015-03-27 13:42:15 -0700 1 1 1 Unclassified WebKit Media 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham bfulgham eric.carlson jer.noble jonlee webkit-bug-importer oldest_to_newest 1080707 0 bfulgham 2015-03-27 12:45:02 -0700 We've seen some crashes due to a null dereference in InbandMetadataTextTrackAVF::updatePendingCueEndTimes. Reviewing the code, I notice that the client() return value is used without null check, even though the other methods in this class due check for null. This patch adds a null check for client()'s return value to avoid this crash. 1080708 1 bfulgham 2015-03-27 12:45:25 -0700 <rdar://problem/18983250> 1080709 2 249598 bfulgham 2015-03-27 12:49:55 -0700 Created attachment 249598 Patch 1080731 3 bfulgham 2015-03-27 13:42:15 -0700 Committed r182076: <http://trac.webkit.org/changeset/182076> 249598 2015-03-27 12:49:55 -0700 2015-03-27 12:52:47 -0700 Patch bug-143144-20150327124916.patch text/plain 2621 bfulgham SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE4MjA3MykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE1LTAzLTI3ICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIE51bGwgZGVyZWZlcmVuY2Ug aW4gSW5iYW5kTWV0YWRhdGFUZXh0VHJhY2sgaGFuZGxpbmcKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MzE0NAorICAgICAgICA8cmRhcjovL3Byb2Js ZW0vMTg5ODMyNTA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9hdmZvdW5kYXRpb24vSW5iYW5kTWV0YWRhdGFUZXh0 VHJhY2tQcml2YXRlQVZGLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkluYmFuZE1ldGFkYXRhVGV4 dFRyYWNrUHJpdmF0ZUFWRjo6dXBkYXRlUGVuZGluZ0N1ZUVuZFRpbWVzKTogQ2hlY2sgZm9yIG51 bGwgcmV0dXJuIHZhbHVlIGZyb20KKyAgICAgICAgJ2NsaWVudCgpJywganVzdCBsaWtlIHdlIGRv IGluIGFsbCBvdGhlciBtZXRob2RzLgorCiAyMDE1LTAzLTI3ICBPbGl2ZXIgSHVudCAgPG9saXZl ckBhcHBsZS5jb20+CiAKICAgICAgICAgRm9yd2FyZCBhZGRpdGlvbmFsIENGTmV0d29yayBBVFMg aW5mb3JtYXRpb24gdG8gY2hpbGQgcHJvY2Vzc2VzCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0 Zm9ybS9ncmFwaGljcy9hdmZvdW5kYXRpb24vSW5iYW5kTWV0YWRhdGFUZXh0VHJhY2tQcml2YXRl QVZGLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9h dmZvdW5kYXRpb24vSW5iYW5kTWV0YWRhdGFUZXh0VHJhY2tQcml2YXRlQVZGLmNwcAkocmV2aXNp b24gMTgyMDczKQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvYXZmb3VuZGF0 aW9uL0luYmFuZE1ldGFkYXRhVGV4dFRyYWNrUHJpdmF0ZUFWRi5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTEsNSArMSw1IEBACiAvKgotICogQ29weXJpZ2h0IChDKSAyMDE0IEFwcGxlIEluYy4gQWxs IHJpZ2h0cyByZXNlcnZlZC4KKyAqIENvcHlyaWdodCAoQykgMjAxNC0yMDE1IEFwcGxlIEluYy4g QWxsIHJpZ2h0cyByZXNlcnZlZC4KICAqCiAgKiBSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNv dXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQKICAqIG1vZGlmaWNhdGlvbiwg YXJlIHBlcm1pdHRlZCBwcm92aWRlZCB0aGF0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9ucwpAQCAt NzEsOSArNzEsMTEgQEAgdm9pZCBJbmJhbmRNZXRhZGF0YVRleHRUcmFja1ByaXZhdGVBVkY6Ogog dm9pZCBJbmJhbmRNZXRhZGF0YVRleHRUcmFja1ByaXZhdGVBVkY6OnVwZGF0ZVBlbmRpbmdDdWVF bmRUaW1lcyhjb25zdCBNZWRpYVRpbWUmIHRpbWUpCiB7CiAgICAgaWYgKHRpbWUgPj0gbV9jdXJy ZW50Q3VlU3RhcnRUaW1lKSB7Ci0gICAgICAgIGZvciAoYXV0byYgcGFydGlhbEN1ZSA6IG1faW5j b21wbGV0ZUN1ZXMpIHsKLSAgICAgICAgICAgIExPRyhNZWRpYSwgIkluYmFuZE1ldGFkYXRhVGV4 dFRyYWNrUHJpdmF0ZUFWRjo6YWRkRGF0YUN1ZSglcCkgLSB1cGRhdGluZyBjdWU6IHN0YXJ0PSVz LCBlbmQ9JXMiLCB0aGlzLCB0b1N0cmluZyhwYXJ0aWFsQ3VlLnN0YXJ0VGltZSkudXRmOCgpLmRh dGEoKSwgdG9TdHJpbmcodGltZSkudXRmOCgpLmRhdGEoKSk7Ci0gICAgICAgICAgICBjbGllbnQo KS0+dXBkYXRlRGF0YUN1ZSh0aGlzLCBwYXJ0aWFsQ3VlLnN0YXJ0VGltZSwgdGltZSwgcGFydGlh bEN1ZS5jdWVEYXRhKTsKKyAgICAgICAgaWYgKGNsaWVudCgpKSB7CisgICAgICAgICAgICBmb3Ig KGF1dG8mIHBhcnRpYWxDdWUgOiBtX2luY29tcGxldGVDdWVzKSB7CisgICAgICAgICAgICAgICAg TE9HKE1lZGlhLCAiSW5iYW5kTWV0YWRhdGFUZXh0VHJhY2tQcml2YXRlQVZGOjphZGREYXRhQ3Vl KCVwKSAtIHVwZGF0aW5nIGN1ZTogc3RhcnQ9JXMsIGVuZD0lcyIsIHRoaXMsIHRvU3RyaW5nKHBh cnRpYWxDdWUuc3RhcnRUaW1lKS51dGY4KCkuZGF0YSgpLCB0b1N0cmluZyh0aW1lKS51dGY4KCku ZGF0YSgpKTsKKyAgICAgICAgICAgICAgICBjbGllbnQoKS0+dXBkYXRlRGF0YUN1ZSh0aGlzLCBw YXJ0aWFsQ3VlLnN0YXJ0VGltZSwgdGltZSwgcGFydGlhbEN1ZS5jdWVEYXRhKTsKKyAgICAgICAg ICAgIH0KICAgICAgICAgfQogICAgIH0gZWxzZQogICAgICAgICBMT0coTWVkaWEsICJJbmJhbmRN ZXRhZGF0YVRleHRUcmFja1ByaXZhdGVBVkY6OmFkZERhdGFDdWUgbmVnYXRpdmUgbGVuZ3RoIGN1 ZShzKSBpZ25vcmVkOiBzdGFydD0lcywgZW5kPSVzXG4iLCB0b1N0cmluZyhtX2N1cnJlbnRDdWVT dGFydFRpbWUpLnV0ZjgoKS5kYXRhKCksIHRvU3RyaW5nKHRpbWUpLnV0ZjgoKS5kYXRhKCkpOwo=