220392 2021-01-06 17:16:31 -0800 null ptr deref with ::highlight {background: red} 2021-01-13 13:04:20 -0800 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa rbuis bfulgham cgarcia ews-feeder gpoo koivisto megan_gardner product-security rbuis svillar webkit-bug-importer wenson_hsieh zalan oldest_to_newest 1717812 0 417142 rniwa 2021-01-06 17:16:31 -0800 Created attachment 417142 Test AddressSanitizer: SEGV on unknown address 0x00000000000c (pc 0x0002274bf3c2 bp 0x7ffee9a9fe40 sp 0x7ffee9a9fe40 T0) #0 0x2274bf3c2 in WTF::Vector<WTF::AtomString, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::size() const+0x22 (WebCore.framework/Versions/A/WebCore:x86_64+0x7d3c2) #1 0x2274bf431 in WTF::Vector<WTF::AtomString, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::at(unsigned long) const+0x11 (WebCore.framework/Versions/A/WebCore:x86_64+0x7d431) #2 0x22a9d198a in WTF::Vector<WTF::AtomString, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::first() const+0xa (WebCore.framework/Versions/A/WebCore:x86_64+0x358f98a) #3 0x22a9cc7ed in WebCore::SelectorChecker::checkOne(WebCore::SelectorChecker::CheckingContext&, WebCore::SelectorChecker::LocalContext const&, WebCore::SelectorChecker::MatchType&) const+0x9ad (WebCore.framework/Versions/A/WebCore:x86_64+0x358a7ed) #4 0x22a9ca7dd in WebCore::SelectorChecker::matchRecursively(WebCore::SelectorChecker::CheckingContext&, WebCore::SelectorChecker::LocalContext const&, WebCore::PseudoIdSet&) const+0x13d (WebCore.framework/Versions/A/WebCore:x86_64+0x35887dd) #5 0x22a9ca33d in WebCore::SelectorChecker::match(WebCore::CSSSelector const&, WebCore::Element const&, WebCore::SelectorChecker::CheckingContext&) const+0x18d (WebCore.framework/Versions/A/WebCore:x86_64+0x358833d) #6 0x22cdeedcf in WebCore::Style::ElementRuleCollector::ruleMatches(WebCore::Style::RuleData const&, unsigned int&)+0x43f (WebCore.framework/Versions/A/WebCore:x86_64+0x59acdcf) #7 0x22cdec067 in WebCore::Style::ElementRuleCollector::collectMatchingRulesForList(WTF::Vector<WebCore::Style::RuleData, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const*, WebCore::Style::MatchRequest const&)+0x227 (WebCore.framework/Versions/A/WebCore:x86_64+0x59aa067) #8 0x22cdebcc3 in WebCore::Style::ElementRuleCollector::collectMatchingRules(WebCore::Style::MatchRequest const&)+0x2f3 (WebCore.framework/Versions/A/WebCore:x86_64+0x59a9cc3) #9 0x22cdecf34 in WebCore::Style::ElementRuleCollector::collectMatchingAuthorRules()+0xc4 (WebCore.framework/Versions/A/WebCore:x86_64+0x59aaf34) #10 0x22cdece55 in WebCore::Style::ElementRuleCollector::matchAuthorRules()+0x15 (WebCore.framework/Versions/A/WebCore:x86_64+0x59aae55) #11 0x22ce5b88c in WebCore::Style::Resolver::pseudoStyleForElement(WebCore::Element const&, WebCore::Style::PseudoElementRequest const&, WebCore::RenderStyle const&, WebCore::RenderStyle const*, WebCore::SelectorFilter const*)+0x2ac (WebCore.framework/Versions/A/WebCore:x86_64+0x5a1988c) #12 0x22ce797c9 in WebCore::Style::TreeResolver::resolvePseudoStyle(WebCore::Element&, WebCore::Style::ElementUpdate const&, WebCore::PseudoId)+0x209 (WebCore.framework/Versions/A/WebCore:x86_64+0x5a377c9) #13 0x22ce786b5 in WebCore::Style::TreeResolver::resolveElement(WebCore::Element&)+0x7f5 (WebCore.framework/Versions/A/WebCore:x86_64+0x5a366b5) #14 0x22ce7a8ae in WebCore::Style::TreeResolver::resolveComposedTree()+0x55e (WebCore.framework/Versions/A/WebCore:x86_64+0x5a388ae) #15 0x22ce7bc18 in WebCore::Style::TreeResolver::resolve()+0x4b8 (WebCore.framework/Versions/A/WebCore:x86_64+0x5a39c18) #16 0x22ac09747 in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType)+0x5b7 (WebCore.framework/Versions/A/WebCore:x86_64+0x37c7747) #17 0x22ac0a6fb in WebCore::Document::updateStyleIfNeeded()+0x23b (WebCore.framework/Versions/A/WebCore:x86_64+0x37c86fb) #18 0x22ac32e07 in WebCore::Document::finishedParsing()+0x247 (WebCore.framework/Versions/A/WebCore:x86_64+0x37f0e07) #19 0x22b56de84 in WebCore::HTMLConstructionSite::finishedParsing()+0x24 (WebCore.framework/Versions/A/WebCore:x86_64+0x412be84) #20 0x22b5d21dd in WebCore::HTMLTreeBuilder::finished()+0x1d (WebCore.framework/Versions/A/WebCore:x86_64+0x41901dd) #21 0x22b576cb7 in WebCore::HTMLDocumentParser::end()+0x17 (WebCore.framework/Versions/A/WebCore:x86_64+0x4134cb7) #22 0x22b574498 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd()+0x38 (WebCore.framework/Versions/A/WebCore:x86_64+0x4132498) #23 0x22b57436a in WebCore::HTMLDocumentParser::prepareToStopParsing()+0x10a (WebCore.framework/Versions/A/WebCore:x86_64+0x413236a) #24 0x22b576cff in WebCore::HTMLDocumentParser::attemptToEnd()+0x3f (WebCore.framework/Versions/A/WebCore:x86_64+0x4134cff) #25 0x22b576dd9 in WebCore::HTMLDocumentParser::finish()+0x29 (WebCore.framework/Versions/A/WebCore:x86_64+0x4134dd9) #26 0x22baf5400 in WebCore::DocumentWriter::end()+0x1a0 (WebCore.framework/Versions/A/WebCore:x86_64+0x46b3400) #27 0x22baa5dbc in WebCore::DocumentLoader::finishedLoading()+0x2dc (WebCore.framework/Versions/A/WebCore:x86_64+0x4663dbc) #28 0x22baa5739 in WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&, WebCore::NetworkLoadMetrics const&)+0x2c9 (WebCore.framework/Versions/A/WebCore:x86_64+0x4663739) #29 0x22bc7a79f in WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&)+0x17f (WebCore.framework/Versions/A/WebCore:x86_64+0x483879f) #30 0x22bc74dee in WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*, WebCore::NetworkLoadMetrics const&)+0x4e (WebCore.framework/Versions/A/WebCore:x86_64+0x4832dee) #31 0x22bc766a8 in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*, WebCore::NetworkLoadMetrics const&)+0x258 (WebCore.framework/Versions/A/WebCore:x86_64+0x48346a8) #32 0x22bbead92 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&)+0x732 (WebCore.framework/Versions/A/WebCore:x86_64+0x47a8d92) #33 0x21a0d3c66 in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&)+0x286 (WebKit.framework/Versions/A/WebKit:x86_64+0x20d1c66) #34 0x21a7ad121 in void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>&&, std::__1::integer_sequence<unsigned long, 0ul>)+0x61 (WebKit.framework/Versions/A/WebKit:x86_64+0x27ab121) #35 0x21a7ad0a8 in void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebCore::NetworkLoadMetrics>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&))+0x28 (WebKit.framework/Versions/A/WebKit:x86_64+0x27ab0a8) #36 0x21a7aab16 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&))+0x146 (WebKit.framework/Versions/A/WebKit:x86_64+0x27a8b16) #37 0x21a7aa123 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&)+0x1a3 (WebKit.framework/Versions/A/WebKit:x86_64+0x27a8123) #38 0x21a0bfc0a in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&)+0xfa (WebKit.framework/Versions/A/WebKit:x86_64+0x20bdc0a) #39 0x2180a5b93 in IPC::Connection::dispatchMessage(IPC::Decoder&)+0x293 (WebKit.framework/Versions/A/WebKit:x86_64+0xa3b93) #40 0x2180a7507 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)+0x167 (WebKit.framework/Versions/A/WebKit:x86_64+0xa5507) #41 0x2180a8026 in IPC::Connection::dispatchOneIncomingMessage()+0x196 (WebKit.framework/Versions/A/WebKit:x86_64+0xa6026) #42 0x2180c65f5 in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_8::operator()()+0x35 (WebKit.framework/Versions/A/WebKit:x86_64+0xc45f5) #43 0x2180c655c in WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_8, void>::call()+0xc (WebKit.framework/Versions/A/WebKit:x86_64+0xc455c) #44 0x2472725ce in WTF::Function<void ()>::operator()() const+0x3e (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x385ce) #45 0x24730ba28 in WTF::RunLoop::performWork()+0x228 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xd1a28) #46 0x24730ed45 in WTF::RunLoop::performWork(void*)+0xb5 (JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xd4d45) <rdar://problem/72094069> 1718769 1 rbuis 2021-01-11 12:03:12 -0800 This should be simple to fix: --- a/Source/WebCore/css/SelectorChecker.cpp +++ b/Source/WebCore/css/SelectorChecker.cpp @@ -1143,7 +1143,7 @@ bool SelectorChecker::checkOne(CheckingContext& checkingContext, const LocalCont // Always matches when not specifically requested so it gets added to the pseudoIdSet. if (checkingContext.pseudoId == PseudoId::None) return true; - if (checkingContext.pseudoId != PseudoId::Highlight) + if (checkingContext.pseudoId != PseudoId::Highlight || !selector.argumentList()) return false; return selector.argumentList()->first() == checkingContext.nameForHightlightPseudoElement; I'll make a patch tomorrow. It does not look like a security bug to me. 1718922 2 417440 rbuis 2021-01-12 01:14:22 -0800 Created attachment 417440 Patch 1719199 3 rniwa 2021-01-12 20:19:41 -0800 Looks like this is not a security issue? 1719208 4 rbuis 2021-01-12 22:12:28 -0800 (In reply to Ryosuke Niwa from comment #3) > Looks like this is not a security issue? Indeed, AFAICS this is not a security issue. 1719398 5 ews-feeder 2021-01-13 13:04:17 -0800 Committed r271451: <https://trac.webkit.org/changeset/271451> All reviewed patches have been landed. Closing bug and clearing flags on attachment 417440. 417142 2021-01-06 17:16:31 -0800 2021-01-06 17:16:31 -0800 Test repro_447.html text/html 47 rniwa PHN0eWxlPgo6OmhpZ2hsaWdodCB7YmFja2dyb3VuZDogcmVkfQo8L3N0eWxlPgo= 417440 2021-01-12 01:14:22 -0800 2021-01-13 13:04:18 -0800 Patch bug-220392-20210112101421.patch text/plain 3194 rbuis U3VidmVyc2lvbiBSZXZpc2lvbjogMjcxMzg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOGI1MGJhNjA1YTY0OTUw N2JlYWIyOTA0ZDM5ZjAyMzk2OWVhMzkyZS4uZDZjZTY4OGU0ZTMwYTRkZjlhNWU5NDVlODkzNTJl MGNmMjg2Nzg3ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDIxLTAxLTEyICBSb2Ig QnVpcyAgPHJidWlzQGlnYWxpYS5jb20+CisKKyAgICAgICAgTnVsbCBjaGVjayBzZWxlY3Rvci5h cmd1bWVudExpc3QoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MjIwMzkyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgTnVsbCBjaGVjayBzZWxlY3Rvci5hcmd1bWVudExpc3QoKS4KKworICAgICAgICBUZXN0 OiBoaWdobGlnaHQvaGlnaGxpZ2h0LWNyYXNoLmh0bWwKKworICAgICAgICAqIGNzcy9TZWxlY3Rv ckNoZWNrZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6U2VsZWN0b3JDaGVja2VyOjpjaGVja09u ZSBjb25zdCk6CisKIDIwMjEtMDEtMTEgIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBs ZS5jb20+CiAKICAgICAgICAgU2FmYXJpIDE0IG9uIDJ4IGRpc3BsYXkgcmVuZGVycyBOWVMgRE1W IHBhZ2UgYXMgYmx1cnJ5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9jc3MvU2VsZWN0b3JD aGVja2VyLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2Nzcy9TZWxlY3RvckNoZWNrZXIuY3BwCmluZGV4 IDdjNzI5ZWZmMTY3YWMwMmE5ZTRmYjliZDcxODQ0OWEzMTEyYjQ2MDEuLmY4OTVlODAwZDk2YTU3 MzBhNmQzMTgzMTUwZDkyMjVlMzEwNWJiMjEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2Nz cy9TZWxlY3RvckNoZWNrZXIuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2Nzcy9TZWxlY3RvckNo ZWNrZXIuY3BwCkBAIC0xMTQzLDcgKzExNDMsNyBAQCBib29sIFNlbGVjdG9yQ2hlY2tlcjo6Y2hl Y2tPbmUoQ2hlY2tpbmdDb250ZXh0JiBjaGVja2luZ0NvbnRleHQsIGNvbnN0IExvY2FsQ29udAog ICAgICAgICAgICAgLy8gQWx3YXlzIG1hdGNoZXMgd2hlbiBub3Qgc3BlY2lmaWNhbGx5IHJlcXVl c3RlZCBzbyBpdCBnZXRzIGFkZGVkIHRvIHRoZSBwc2V1ZG9JZFNldC4KICAgICAgICAgICAgIGlm IChjaGVja2luZ0NvbnRleHQucHNldWRvSWQgPT0gUHNldWRvSWQ6Ok5vbmUpCiAgICAgICAgICAg ICAgICAgcmV0dXJuIHRydWU7Ci0gICAgICAgICAgICBpZiAoY2hlY2tpbmdDb250ZXh0LnBzZXVk b0lkICE9IFBzZXVkb0lkOjpIaWdobGlnaHQpCisgICAgICAgICAgICBpZiAoY2hlY2tpbmdDb250 ZXh0LnBzZXVkb0lkICE9IFBzZXVkb0lkOjpIaWdobGlnaHQgfHwgIXNlbGVjdG9yLmFyZ3VtZW50 TGlzdCgpKQogICAgICAgICAgICAgICAgIHJldHVybiBmYWxzZTsKICAgICAgICAgICAgIHJldHVy biBzZWxlY3Rvci5hcmd1bWVudExpc3QoKS0+Zmlyc3QoKSA9PSBjaGVja2luZ0NvbnRleHQubmFt ZUZvckhpZ2h0bGlnaHRQc2V1ZG9FbGVtZW50OwogCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9D aGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggM2U2ZmVjYWYxZDc0OWQ0ZDQ1 YjU1MGFiN2ExMzM4NmE1NmMxZWEzMi4uMTUwY2I2MzA2OWM1Y2IyYTI5MzJjODJhNGE3ZDEyOTBm ZTcxOTc5MyAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRl c3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIxLTAxLTEyICBSb2IgQnVpcyAgPHJi dWlzQGlnYWxpYS5jb20+CisKKyAgICAgICAgTnVsbCBjaGVjayBzZWxlY3Rvci5hcmd1bWVudExp c3QoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIw MzkyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRk IHRlc3QgdGhhdCB0cmlnZ2VycyB0aGUgcmVsZXZhbnQgY29kZSBwYXRoLgorCisgICAgICAgICog aGlnaGxpZ2h0L2hpZ2hsaWdodC1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAq IGhpZ2hsaWdodC9oaWdobGlnaHQtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMjEtMDEtMTEgIFNp bW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CiAKICAgICAgICAgU2FmYXJpIDE0 IG9uIDJ4IGRpc3BsYXkgcmVuZGVycyBOWVMgRE1WIHBhZ2UgYXMgYmx1cnJ5CmRpZmYgLS1naXQg YS9MYXlvdXRUZXN0cy9oaWdobGlnaHQvaGlnaGxpZ2h0LWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xh eW91dFRlc3RzL2hpZ2hsaWdodC9oaWdobGlnaHQtY3Jhc2gtZXhwZWN0ZWQudHh0Cm5ldyBmaWxl IG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAuLmZjMDY2MGNmN2ExOTliZGM4ODU2OTkzZGQ1Nzc2YzJkZWRhMTM1NmQKLS0tIC9kZXYvbnVs bAorKysgYi9MYXlvdXRUZXN0cy9oaWdobGlnaHQvaGlnaGxpZ2h0LWNyYXNoLWV4cGVjdGVkLnR4 dApAQCAtMCwwICsxIEBACitUaGlzIHRlc3Qgc2hvdWxkIG5vdCBjcmFzaC4KZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL2hpZ2hsaWdodC9oaWdobGlnaHQtY3Jhc2guaHRtbCBiL0xheW91dFRlc3Rz L2hpZ2hsaWdodC9oaWdobGlnaHQtY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi4zYzk4NGIwODEwNWQ2 ZDAzYjBiY2I2ZTc2ZGRhMjBiMTc5MDRkNWQyCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVz dHMvaGlnaGxpZ2h0L2hpZ2hsaWdodC1jcmFzaC5odG1sCkBAIC0wLDAgKzEsOSBAQAorPCFET0NU WVBFIGh0bWw+IDwhLS0gd2Via2l0LXRlc3QtcnVubmVyIFsgSGlnaGxpZ2h0QVBJRW5hYmxlZD10 cnVlIF0gLS0+Cis8c3R5bGU+Cis6OmhpZ2hsaWdodCB7IGJhY2tncm91bmQ6IHJlZCB9Cis8L3N0 eWxlPgorPHNjcmlwdD4KK2lmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1 bXBBc1RleHQoKTsKKzwvc2NyaXB0PgorPHA+VGhpcyB0ZXN0IHNob3VsZCBub3QgY3Jhc2guPC9w Pgo=