219651 2020-12-08 12:31:45 -0800 REGRESSION(r254841): Possible null pointer reference in BitmapImage::preTransformedNativeImageForCurrentFrame() 2020-12-08 16:11:08 -0800 1 1 1 Unclassified WebKit Images WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 sabouhallawa sabouhallawa simon.fraser thorton webkit-bug-importer oldest_to_newest 1712868 0 sabouhallawa 2020-12-08 12:31:45 -0800 This function was added in r254841 under the name BitmapImage::nativeImageForCurrentFrameRespectingOrientation() without checking whether the resulted image of nativeImageForCurrentFrame() is null or not. If the ImageSource is corrupted, the decoder might return a null PlatformImagePtr for the current frame. And if this happens most likely ImageSource::densityCorrectedSize() will return WTF::nullopt also. In this case, we end up calling GraphicsContext::drawPlatformImage() with a null PlatformImagePtr. 1712874 1 sabouhallawa 2020-12-08 12:43:49 -0800 <rdar://problem/71907384> 1712883 2 415666 sabouhallawa 2020-12-08 13:09:39 -0800 Created attachment 415666 Patch 1712967 3 ews-feeder 2020-12-08 16:11:06 -0800 Committed r270562: <https://trac.webkit.org/changeset/270562> All reviewed patches have been landed. Closing bug and clearing flags on attachment 415666. 415666 2020-12-08 13:09:39 -0800 2020-12-08 16:11:07 -0800 Patch bug-219651-20201208130938.patch text/plain 2210 sabouhallawa U3VidmVyc2lvbiBSZXZpc2lvbjogMjcwNTUxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZjg4YWQ3N2FjMzA5NTJi YWYxMGMxMjFjY2NlYzVjYWMzNzA3NTY5ZS4uZmEzNTA0MDMwNGZiNDljNWVmYjQ2ZGI5MTAxZjhi ZmE4OWE2OTViNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDIwLTEyLTA4ICBTYWlk IEFib3UtSGFsbGF3YSAgPHNhaWRAYXBwbGUuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04ocjI1 NDg0MSk6IFBvc3NpYmxlIG51bGwgcG9pbnRlciByZWZlcmVuY2UgaW4gQml0bWFwSW1hZ2U6OnBy ZVRyYW5zZm9ybWVkTmF0aXZlSW1hZ2VGb3JDdXJyZW50RnJhbWUoKQorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjE5NjUxCisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgcHJlVHJhbnNmb3JtZWROYXRpdmVJbWFn ZUZvckN1cnJlbnRGcmFtZSgpIHdhcyBhZGRlZCBpbiByMjU0ODQxIHVuZGVyIHRoZQorICAgICAg ICBuYW1lIG5hdGl2ZUltYWdlRm9yQ3VycmVudEZyYW1lUmVzcGVjdGluZ09yaWVudGF0aW9uKCkg d2l0aG91dCBjaGVja2luZworICAgICAgICB3aGV0aGVyIHRoZSByZXN1bHRlZCBpbWFnZSBvZiBu YXRpdmVJbWFnZUZvckN1cnJlbnRGcmFtZSgpIGlzIG51bGwgb3Igbm90LgorICAgICAgICBJZiB0 aGUgSW1hZ2VTb3VyY2UgaXMgY29ycnVwdGVkLCB0aGUgZGVjb2RlciBtaWdodCByZXR1cm4gYSBu dWxsCisgICAgICAgIFBsYXRmb3JtSW1hZ2VQdHIgZm9yIHRoZSBjdXJyZW50IGZyYW1lLiBBbmQg aWYgdGhpcyBoYXBwZW5zIG1vc3QgbGlrZWx5CisgICAgICAgIEltYWdlU291cmNlOjpkZW5zaXR5 Q29ycmVjdGVkU2l6ZSgpIHdpbGwgcmV0dXJuIFdURjo6bnVsbG9wdCBhbHNvLiBJbiB0aGlzCisg ICAgICAgIGNhc2UsIHdlIGVuZCB1cCBjYWxsaW5nIEdyYXBoaWNzQ29udGV4dDo6ZHJhd1BsYXRm b3JtSW1hZ2UoKSB3aXRoIGEgbnVsbAorICAgICAgICBQbGF0Zm9ybUltYWdlUHRyLgorCisgICAg ICAgICogcGxhdGZvcm0vZ3JhcGhpY3MvQml0bWFwSW1hZ2UuY3BwOgorICAgICAgICAoV2ViQ29y ZTo6Qml0bWFwSW1hZ2U6OnByZVRyYW5zZm9ybWVkTmF0aXZlSW1hZ2VGb3JDdXJyZW50RnJhbWUp OgorCiAyMDIwLTEyLTA4ICBSb2IgQnVpcyAgPHJidWlzQGlnYWxpYS5jb20+CiAKICAgICAgICAg U3VwcG9ydCBhc3BlY3QtcmF0aW8gb24gbm9uLXJlcGxhY2VkIGVsZW1lbnRzCmRpZmYgLS1naXQg YS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9CaXRtYXBJbWFnZS5jcHAgYi9Tb3Vy Y2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9CaXRtYXBJbWFnZS5jcHAKaW5kZXggMDc5MmRj Yzk3ZWU1MGRlMTQ2MjMxM2U1ZTUzNTA3ZWQ3MmU5NTM5MS4uMzQ2Njk1Njg0Yzk4MmJhMTAzNzQw NzMwZTc2NTE1ZTU0Y2IzNzEwNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0v Z3JhcGhpY3MvQml0bWFwSW1hZ2UuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dy YXBoaWNzL0JpdG1hcEltYWdlLmNwcApAQCAtMTU1LDYgKzE1NSw4IEBAIFJlZlB0cjxOYXRpdmVJ bWFnZT4gQml0bWFwSW1hZ2U6Om5hdGl2ZUltYWdlRm9yQ3VycmVudEZyYW1lKGNvbnN0IEdyYXBo aWNzQ29udGV4CiBSZWZQdHI8TmF0aXZlSW1hZ2U+IEJpdG1hcEltYWdlOjpwcmVUcmFuc2Zvcm1l ZE5hdGl2ZUltYWdlRm9yQ3VycmVudEZyYW1lKGJvb2wgcmVzcGVjdE9yaWVudGF0aW9uLCBjb25z dCBHcmFwaGljc0NvbnRleHQqIHRhcmdldENvbnRleHQpCiB7CiAgICAgYXV0byBpbWFnZSA9IG5h dGl2ZUltYWdlRm9yQ3VycmVudEZyYW1lKHRhcmdldENvbnRleHQpOworICAgIGlmICghaW1hZ2Up CisgICAgICAgIHJldHVybiBpbWFnZTsKIAogICAgIGF1dG8gb3JpZW50YXRpb24gPSByZXNwZWN0 T3JpZW50YXRpb24gPyBvcmllbnRhdGlvbkZvckN1cnJlbnRGcmFtZSgpIDogSW1hZ2VPcmllbnRh dGlvbihJbWFnZU9yaWVudGF0aW9uOjpOb25lKTsKICAgICBhdXRvIGNvcnJlY3RlZFNpemUgPSBt X3NvdXJjZS0+ZGVuc2l0eUNvcnJlY3RlZFNpemUob3JpZW50YXRpb24pOwo=