45896 CVE-2011-0113 2010-09-16 09:20:47 -0700 CSS: Fix crash in getTimingFunctionValue() 2011-03-03 15:44:14 -0800 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 kling webkit-unassigned dino simon.fraser vdanen oldest_to_newest 280133 0 kling 2010-09-16 09:20:47 -0700 Since TimingFunctions are refcounted since http://trac.webkit.org/changeset/67032 we need to store them using RefPtr rather than TimingFunction*. 280136 1 67803 kling 2010-09-16 09:23:09 -0700 Created attachment 67803 Proposed patch 280137 2 67803 simon.fraser 2010-09-16 09:23:39 -0700 Comment on attachment 67803 Proposed patch Needs a testcase. 280150 3 kling 2010-09-16 09:39:59 -0700 (In reply to comment #2) > (From update of attachment 67803 [details]) > Needs a testcase. Right, sorry. This is already covered by existing tests, for example transitions/inherit-other-props.html. You'll only get an actual crash on picky platforms (or valgrind ;-)) 280164 4 67803 simon.fraser 2010-09-16 09:56:47 -0700 Comment on attachment 67803 Proposed patch > diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog > index 13da8c8..7277379 100644 > --- a/WebCore/ChangeLog > +++ b/WebCore/ChangeLog > @@ -1,3 +1,15 @@ > +2010-09-16 Andreas Kling <andreas.kling@nokia.com> > + > + Reviewed by NOBODY (OOPS!). > + > + CSS: Fix crash in getTimingFunctionValue() > + https://bugs.webkit.org/show_bug.cgi?id=45896 > + > + Use RefPtrs to avoid deleting the TimingFunctions prematurely. You should say here why you didn't add any tests. > diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp > index ce96e1c..f351cd7 100644 > --- a/WebCore/css/CSSComputedStyleDeclaration.cpp > +++ b/WebCore/css/CSSComputedStyleDeclaration.cpp > @@ -514,12 +514,12 @@ static PassRefPtr<CSSValue> getTimingFunctionValue(const AnimationList* animList > RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated(); > if (animList) { > for (size_t i = 0; i < animList->size(); ++i) { > - const TimingFunction* tf = animList->animation(i)->timingFunction().get(); > + RefPtr<TimingFunction> tf = animList->animation(i)->timingFunction(); I don't see why this RefPtr is needed. How can animList->animation(i)->timingFunction() go bad here? 280175 5 67815 kling 2010-09-16 10:11:55 -0700 Created attachment 67815 Proposed patch v2 Updated ChangeLog with information about test coverage. Removed the unnecessary guard for Animation::timingFunction(). 280186 6 67815 kling 2010-09-16 10:21:08 -0700 Comment on attachment 67815 Proposed patch v2 Clearing flags on attachment: 67815 Committed r67634: <http://trac.webkit.org/changeset/67634> 280188 7 kling 2010-09-16 10:21:18 -0700 All reviewed patches have been landed. Closing bug. 317324 8 ddkilzer 2010-12-04 16:47:06 -0800 <rdar://problem/8730620> 362021 9 vdanen 2011-03-03 15:44:14 -0800 This was assigned CVE-2011-0113. 67803 2010-09-16 09:23:09 -0700 2010-09-16 10:11:55 -0700 Proposed patch bug-45896.diff text/plain 3324 kling ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg MTNkYThjOC4uNzI3NzM3OSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAxMC0wOS0xNiAgQW5kcmVhcyBLbGlu ZyAgPGFuZHJlYXMua2xpbmdAbm9raWEuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIENTUzogRml4IGNyYXNoIGluIGdldFRpbWluZ0Z1bmN0aW9u VmFsdWUoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 NDU4OTYKKworICAgICAgICBVc2UgUmVmUHRycyB0byBhdm9pZCBkZWxldGluZyB0aGUgVGltaW5n RnVuY3Rpb25zIHByZW1hdHVyZWx5LgorCisgICAgICAgICogY3NzL0NTU0NvbXB1dGVkU3R5bGVE ZWNsYXJhdGlvbi5jcHA6CisgICAgICAgIChXZWJDb3JlOjpnZXRUaW1pbmdGdW5jdGlvblZhbHVl KToKKwogMjAxMC0wOS0xNiAgRGllZ28gR29uemFsZXogIDxkaWVnb2hjZ0B3ZWJraXQub3JnPgog CiAgICAgICAgIFJldmlld2VkIGJ5IEtlbm5ldGggUm9oZGUgQ2hyaXN0aWFuc2VuLgpkaWZmIC0t Z2l0IGEvV2ViQ29yZS9jc3MvQ1NTQ29tcHV0ZWRTdHlsZURlY2xhcmF0aW9uLmNwcCBiL1dlYkNv cmUvY3NzL0NTU0NvbXB1dGVkU3R5bGVEZWNsYXJhdGlvbi5jcHAKaW5kZXggY2U5NmUxYy4uZjM1 MWNkNyAxMDA2NDQKLS0tIGEvV2ViQ29yZS9jc3MvQ1NTQ29tcHV0ZWRTdHlsZURlY2xhcmF0aW9u LmNwcAorKysgYi9XZWJDb3JlL2Nzcy9DU1NDb21wdXRlZFN0eWxlRGVjbGFyYXRpb24uY3BwCkBA IC01MTQsMTIgKzUxNCwxMiBAQCBzdGF0aWMgUGFzc1JlZlB0cjxDU1NWYWx1ZT4gZ2V0VGltaW5n RnVuY3Rpb25WYWx1ZShjb25zdCBBbmltYXRpb25MaXN0KiBhbmltTGlzdAogICAgIFJlZlB0cjxD U1NWYWx1ZUxpc3Q+IGxpc3QgPSBDU1NWYWx1ZUxpc3Q6OmNyZWF0ZUNvbW1hU2VwYXJhdGVkKCk7 CiAgICAgaWYgKGFuaW1MaXN0KSB7CiAgICAgICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgYW5p bUxpc3QtPnNpemUoKTsgKytpKSB7Ci0gICAgICAgICAgICBjb25zdCBUaW1pbmdGdW5jdGlvbiog dGYgPSBhbmltTGlzdC0+YW5pbWF0aW9uKGkpLT50aW1pbmdGdW5jdGlvbigpLmdldCgpOworICAg ICAgICAgICAgUmVmUHRyPFRpbWluZ0Z1bmN0aW9uPiB0ZiA9IGFuaW1MaXN0LT5hbmltYXRpb24o aSktPnRpbWluZ0Z1bmN0aW9uKCk7CiAgICAgICAgICAgICBpZiAodGYtPmlzQ3ViaWNCZXppZXJU aW1pbmdGdW5jdGlvbigpKSB7Ci0gICAgICAgICAgICAgICAgY29uc3QgQ3ViaWNCZXppZXJUaW1p bmdGdW5jdGlvbiogY3RmID0gc3RhdGljX2Nhc3Q8Y29uc3QgQ3ViaWNCZXppZXJUaW1pbmdGdW5j dGlvbio+KHRmKTsKKyAgICAgICAgICAgICAgICBjb25zdCBDdWJpY0JlemllclRpbWluZ0Z1bmN0 aW9uKiBjdGYgPSBzdGF0aWNfY2FzdDxjb25zdCBDdWJpY0JlemllclRpbWluZ0Z1bmN0aW9uKj4o dGYuZ2V0KCkpOwogICAgICAgICAgICAgICAgIGxpc3QtPmFwcGVuZChDU1NDdWJpY0JlemllclRp bWluZ0Z1bmN0aW9uVmFsdWU6OmNyZWF0ZShjdGYtPngxKCksIGN0Zi0+eTEoKSwgY3RmLT54Migp LCBjdGYtPnkyKCkpKTsKICAgICAgICAgICAgIH0gZWxzZSBpZiAodGYtPmlzU3RlcHNUaW1pbmdG dW5jdGlvbigpKSB7Ci0gICAgICAgICAgICAgICAgY29uc3QgU3RlcHNUaW1pbmdGdW5jdGlvbiog c3RmID0gc3RhdGljX2Nhc3Q8Y29uc3QgU3RlcHNUaW1pbmdGdW5jdGlvbio+KHRmKTsKKyAgICAg ICAgICAgICAgICBjb25zdCBTdGVwc1RpbWluZ0Z1bmN0aW9uKiBzdGYgPSBzdGF0aWNfY2FzdDxj b25zdCBTdGVwc1RpbWluZ0Z1bmN0aW9uKj4odGYuZ2V0KCkpOwogICAgICAgICAgICAgICAgIGxp c3QtPmFwcGVuZChDU1NTdGVwc1RpbWluZ0Z1bmN0aW9uVmFsdWU6OmNyZWF0ZShzdGYtPm51bWJl ck9mU3RlcHMoKSwgc3RmLT5zdGVwQXRTdGFydCgpKSk7CiAgICAgICAgICAgICB9IGVsc2Ugewog ICAgICAgICAgICAgICAgIGxpc3QtPmFwcGVuZChDU1NMaW5lYXJUaW1pbmdGdW5jdGlvblZhbHVl OjpjcmVhdGUoKSk7CkBAIC01MjcsMTIgKzUyNywxMiBAQCBzdGF0aWMgUGFzc1JlZlB0cjxDU1NW YWx1ZT4gZ2V0VGltaW5nRnVuY3Rpb25WYWx1ZShjb25zdCBBbmltYXRpb25MaXN0KiBhbmltTGlz dAogICAgICAgICB9CiAgICAgfSBlbHNlIHsKICAgICAgICAgLy8gTm90ZSB0aGF0IGluaXRpYWxB bmltYXRpb25UaW1pbmdGdW5jdGlvbigpIGlzIHVzZWQgZm9yIGJvdGggdHJhbnNpdGlvbnMgYW5k IGFuaW1hdGlvbnMKLSAgICAgICAgY29uc3QgVGltaW5nRnVuY3Rpb24qIHRmID0gQW5pbWF0aW9u Ojppbml0aWFsQW5pbWF0aW9uVGltaW5nRnVuY3Rpb24oKS5nZXQoKTsKKyAgICAgICAgUmVmUHRy PFRpbWluZ0Z1bmN0aW9uPiB0ZiA9IEFuaW1hdGlvbjo6aW5pdGlhbEFuaW1hdGlvblRpbWluZ0Z1 bmN0aW9uKCk7CiAgICAgICAgIGlmICh0Zi0+aXNDdWJpY0JlemllclRpbWluZ0Z1bmN0aW9uKCkp IHsKLSAgICAgICAgICAgIGNvbnN0IEN1YmljQmV6aWVyVGltaW5nRnVuY3Rpb24qIGN0ZiA9IHN0 YXRpY19jYXN0PGNvbnN0IEN1YmljQmV6aWVyVGltaW5nRnVuY3Rpb24qPih0Zik7CisgICAgICAg ICAgICBjb25zdCBDdWJpY0JlemllclRpbWluZ0Z1bmN0aW9uKiBjdGYgPSBzdGF0aWNfY2FzdDxj b25zdCBDdWJpY0JlemllclRpbWluZ0Z1bmN0aW9uKj4odGYuZ2V0KCkpOwogICAgICAgICAgICAg bGlzdC0+YXBwZW5kKENTU0N1YmljQmV6aWVyVGltaW5nRnVuY3Rpb25WYWx1ZTo6Y3JlYXRlKGN0 Zi0+eDEoKSwgY3RmLT55MSgpLCBjdGYtPngyKCksIGN0Zi0+eTIoKSkpOwogICAgICAgICB9IGVs c2UgaWYgKHRmLT5pc1N0ZXBzVGltaW5nRnVuY3Rpb24oKSkgewotICAgICAgICAgICAgY29uc3Qg U3RlcHNUaW1pbmdGdW5jdGlvbiogc3RmID0gc3RhdGljX2Nhc3Q8Y29uc3QgU3RlcHNUaW1pbmdG dW5jdGlvbio+KHRmKTsKKyAgICAgICAgICAgIGNvbnN0IFN0ZXBzVGltaW5nRnVuY3Rpb24qIHN0 ZiA9IHN0YXRpY19jYXN0PGNvbnN0IFN0ZXBzVGltaW5nRnVuY3Rpb24qPih0Zi5nZXQoKSk7CiAg ICAgICAgICAgICBsaXN0LT5hcHBlbmQoQ1NTU3RlcHNUaW1pbmdGdW5jdGlvblZhbHVlOjpjcmVh dGUoc3RmLT5udW1iZXJPZlN0ZXBzKCksIHN0Zi0+c3RlcEF0U3RhcnQoKSkpOwogICAgICAgICB9 IGVsc2UgewogICAgICAgICAgICAgbGlzdC0+YXBwZW5kKENTU0xpbmVhclRpbWluZ0Z1bmN0aW9u VmFsdWU6OmNyZWF0ZSgpKTsK 67815 2010-09-16 10:11:55 -0700 2010-09-16 10:21:08 -0700 Proposed patch v2 bug-45896-v2.diff text/plain 2217 kling ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg MTNkYThjOC4uZWJmOGRkZSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxOCBAQAorMjAxMC0wOS0xNiAgQW5kcmVhcyBLbGlu ZyAgPGFuZHJlYXMua2xpbmdAbm9raWEuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIENTUzogRml4IGNyYXNoIGluIGdldFRpbWluZ0Z1bmN0aW9u VmFsdWUoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 NDU4OTYKKworICAgICAgICBVc2UgYSBSZWZQdHIgdG8gYXZvaWQgZGVsZXRpbmcgdGhlIFRpbWlu Z0Z1bmN0aW9uIHByZW1hdHVyZWx5LgorCisgICAgICAgIFRoaXMgaXMgY292ZXJlZCBieSBleGlz dGluZyB0ZXN0cywgZS5nIHRyYW5zaXRpb25zL2luaGVyaXQtb3RoZXItcHJvcHMuaHRtbAorICAg ICAgICBidXQgd2lsbCBvbmx5IGFjdHVhbGx5IGNyYXNoIG9uIHBpY2t5IHBsYXRmb3JtcyAob3Ig aW4gdmFsZ3JpbmQuKQorCisgICAgICAgICogY3NzL0NTU0NvbXB1dGVkU3R5bGVEZWNsYXJhdGlv bi5jcHA6CisgICAgICAgIChXZWJDb3JlOjpnZXRUaW1pbmdGdW5jdGlvblZhbHVlKToKKwogMjAx MC0wOS0xNiAgRGllZ28gR29uemFsZXogIDxkaWVnb2hjZ0B3ZWJraXQub3JnPgogCiAgICAgICAg IFJldmlld2VkIGJ5IEtlbm5ldGggUm9oZGUgQ2hyaXN0aWFuc2VuLgpkaWZmIC0tZ2l0IGEvV2Vi Q29yZS9jc3MvQ1NTQ29tcHV0ZWRTdHlsZURlY2xhcmF0aW9uLmNwcCBiL1dlYkNvcmUvY3NzL0NT U0NvbXB1dGVkU3R5bGVEZWNsYXJhdGlvbi5jcHAKaW5kZXggY2U5NmUxYy4uYWI5NjM0NyAxMDA2 NDQKLS0tIGEvV2ViQ29yZS9jc3MvQ1NTQ29tcHV0ZWRTdHlsZURlY2xhcmF0aW9uLmNwcAorKysg Yi9XZWJDb3JlL2Nzcy9DU1NDb21wdXRlZFN0eWxlRGVjbGFyYXRpb24uY3BwCkBAIC01MjcsMTIg KzUyNywxMiBAQCBzdGF0aWMgUGFzc1JlZlB0cjxDU1NWYWx1ZT4gZ2V0VGltaW5nRnVuY3Rpb25W YWx1ZShjb25zdCBBbmltYXRpb25MaXN0KiBhbmltTGlzdAogICAgICAgICB9CiAgICAgfSBlbHNl IHsKICAgICAgICAgLy8gTm90ZSB0aGF0IGluaXRpYWxBbmltYXRpb25UaW1pbmdGdW5jdGlvbigp IGlzIHVzZWQgZm9yIGJvdGggdHJhbnNpdGlvbnMgYW5kIGFuaW1hdGlvbnMKLSAgICAgICAgY29u c3QgVGltaW5nRnVuY3Rpb24qIHRmID0gQW5pbWF0aW9uOjppbml0aWFsQW5pbWF0aW9uVGltaW5n RnVuY3Rpb24oKS5nZXQoKTsKKyAgICAgICAgUmVmUHRyPFRpbWluZ0Z1bmN0aW9uPiB0ZiA9IEFu aW1hdGlvbjo6aW5pdGlhbEFuaW1hdGlvblRpbWluZ0Z1bmN0aW9uKCk7CiAgICAgICAgIGlmICh0 Zi0+aXNDdWJpY0JlemllclRpbWluZ0Z1bmN0aW9uKCkpIHsKLSAgICAgICAgICAgIGNvbnN0IEN1 YmljQmV6aWVyVGltaW5nRnVuY3Rpb24qIGN0ZiA9IHN0YXRpY19jYXN0PGNvbnN0IEN1YmljQmV6 aWVyVGltaW5nRnVuY3Rpb24qPih0Zik7CisgICAgICAgICAgICBjb25zdCBDdWJpY0JlemllclRp bWluZ0Z1bmN0aW9uKiBjdGYgPSBzdGF0aWNfY2FzdDxjb25zdCBDdWJpY0JlemllclRpbWluZ0Z1 bmN0aW9uKj4odGYuZ2V0KCkpOwogICAgICAgICAgICAgbGlzdC0+YXBwZW5kKENTU0N1YmljQmV6 aWVyVGltaW5nRnVuY3Rpb25WYWx1ZTo6Y3JlYXRlKGN0Zi0+eDEoKSwgY3RmLT55MSgpLCBjdGYt PngyKCksIGN0Zi0+eTIoKSkpOwogICAgICAgICB9IGVsc2UgaWYgKHRmLT5pc1N0ZXBzVGltaW5n RnVuY3Rpb24oKSkgewotICAgICAgICAgICAgY29uc3QgU3RlcHNUaW1pbmdGdW5jdGlvbiogc3Rm ID0gc3RhdGljX2Nhc3Q8Y29uc3QgU3RlcHNUaW1pbmdGdW5jdGlvbio+KHRmKTsKKyAgICAgICAg ICAgIGNvbnN0IFN0ZXBzVGltaW5nRnVuY3Rpb24qIHN0ZiA9IHN0YXRpY19jYXN0PGNvbnN0IFN0 ZXBzVGltaW5nRnVuY3Rpb24qPih0Zi5nZXQoKSk7CiAgICAgICAgICAgICBsaXN0LT5hcHBlbmQo Q1NTU3RlcHNUaW1pbmdGdW5jdGlvblZhbHVlOjpjcmVhdGUoc3RmLT5udW1iZXJPZlN0ZXBzKCks IHN0Zi0+c3RlcEF0U3RhcnQoKSkpOwogICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgbGlz dC0+YXBwZW5kKENTU0xpbmVhclRpbWluZ0Z1bmN0aW9uVmFsdWU6OmNyZWF0ZSgpKTsK