83538 2012-04-09 19:11:21 -0700 Don't let CSSPropertyWebkitPerspective dereference primitiveValue without null check. 2012-04-09 21:48:15 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 macpherson macpherson cmarrin dbates macpherson menard simon.fraser webkit.review.bot oldest_to_newest 598887 0 macpherson 2012-04-09 19:11:21 -0700 Don't let CSSPropertyWebkitPerspective dereference primitiveValue without null check. 598892 1 136373 macpherson 2012-04-09 19:14:04 -0700 Created attachment 136373 Patch 598951 2 136373 dbates 2012-04-09 20:30:53 -0700 Comment on attachment 136373 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=136373&action=review > Source/WebCore/ChangeLog:12 > + Coverity pointed out that we potentially dereference primitiveValue here without checking for null. > + I've added an early out for that case to make sure it can't ever happen. I don't know if it's actually > + possible to exercise that code path or not - probably the parser prevents it from being hit in practice. Have you tried writing a test? 598965 3 macpherson 2012-04-09 20:53:59 -0700 I've read the parser code and can't see an obvious way to exercise this code path. I still think it's best to make the code obviously correct (and reduce false-positives coming from static analysis). 598992 4 136373 webkit.review.bot 2012-04-09 21:48:10 -0700 Comment on attachment 136373 Patch Clearing flags on attachment: 136373 Committed r113676: <http://trac.webkit.org/changeset/113676> 598993 5 webkit.review.bot 2012-04-09 21:48:15 -0700 All reviewed patches have been landed. Closing bug. 136373 2012-04-09 19:14:04 -0700 2012-04-09 21:48:10 -0700 Patch bug-83538-20120410121402.patch text/plain 1866 macpherson U3VidmVyc2lvbiBSZXZpc2lvbjogMTEzNjU3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNDYyMzMyODk0OWQ0YjJk NmNjZDc1MjM3Mzg1MWYzMWRmNzZmNzRiZi4uMzFiYzlmYzc1MzE3N2RmN2E0MDBiNDM4YmVlMGE1 YzhlMTExNmM4NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDEyLTA0LTA5ICBMdWtl IE1hY3BoZXJzb24gIDxtYWNwaGVyc29uQGNocm9taXVtLm9yZz4KKworICAgICAgICBEb24ndCBs ZXQgQ1NTUHJvcGVydHlXZWJraXRQZXJzcGVjdGl2ZSBkZXJlZmVyZW5jZSBwcmltaXRpdmVWYWx1 ZSB3aXRob3V0IG51bGwgY2hlY2suCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD04MzUzOAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIE5vIG5ldyB0ZXN0cyAvIGNvZGUgY2xlYW51cCBvbmx5LgorCisgICAgICAg IENvdmVyaXR5IHBvaW50ZWQgb3V0IHRoYXQgd2UgcG90ZW50aWFsbHkgZGVyZWZlcmVuY2UgcHJp bWl0aXZlVmFsdWUgaGVyZSB3aXRob3V0IGNoZWNraW5nIGZvciBudWxsLgorICAgICAgICBJJ3Zl IGFkZGVkIGFuIGVhcmx5IG91dCBmb3IgdGhhdCBjYXNlIHRvIG1ha2Ugc3VyZSBpdCBjYW4ndCBl dmVyIGhhcHBlbi4gSSBkb24ndCBrbm93IGlmIGl0J3MgYWN0dWFsbHkKKyAgICAgICAgcG9zc2li bGUgdG8gZXhlcmNpc2UgdGhhdCBjb2RlIHBhdGggb3Igbm90IC0gcHJvYmFibHkgdGhlIHBhcnNl ciBwcmV2ZW50cyBpdCBmcm9tIGJlaW5nIGhpdCBpbiBwcmFjdGljZS4KKworICAgICAgICAqIGNz cy9DU1NTdHlsZVNlbGVjdG9yLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNTU1N0eWxlU2VsZWN0 b3I6OmNvbGxlY3RNYXRjaGluZ1J1bGVzRm9yTGlzdCk6CisKIDIwMTItMDQtMDkgIEdyZWcgQmls bG9jayAgPGdiaWxsb2NrQGdvb2dsZS5jb20+CiAKICAgICAgICAgQWRkIHRyYW5zZmVyIG1hcCBh cmd1bWVudCB0byBJbnRlbnQgY29uc3RydWN0b3IKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3Jl L2Nzcy9DU1NTdHlsZVNlbGVjdG9yLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2Nzcy9DU1NTdHlsZVNl bGVjdG9yLmNwcAppbmRleCAzYjczYTMyYzJkNjJlNTUzMGNkNWNjMTI2NDE3ZDA4YTU0NWRjYWRj Li45NWQ2ZDc4YjlmMDc0MDg3ZjY1YWUyMmEzMWRlNTRmNTQyOTE5OTFkIDEwMDY0NAotLS0gYS9T b3VyY2UvV2ViQ29yZS9jc3MvQ1NTU3R5bGVTZWxlY3Rvci5jcHAKKysrIGIvU291cmNlL1dlYkNv cmUvY3NzL0NTU1N0eWxlU2VsZWN0b3IuY3BwCkBAIC0zNjQzLDcgKzM2NDMsMTEgQEAgdm9pZCBD U1NTdHlsZVNlbGVjdG9yOjphcHBseVByb3BlcnR5KENTU1Byb3BlcnR5SUQgaWQsIENTU1ZhbHVl ICp2YWx1ZSkKICAgICB9CiAgICAgY2FzZSBDU1NQcm9wZXJ0eVdlYmtpdFBlcnNwZWN0aXZlOiB7 CiAgICAgICAgIEhBTkRMRV9JTkhFUklUX0FORF9JTklUSUFMKHBlcnNwZWN0aXZlLCBQZXJzcGVj dGl2ZSkKLSAgICAgICAgaWYgKHByaW1pdGl2ZVZhbHVlICYmIHByaW1pdGl2ZVZhbHVlLT5nZXRJ ZGVudCgpID09IENTU1ZhbHVlTm9uZSkgeworCisgICAgICAgIGlmICghcHJpbWl0aXZlVmFsdWUp CisgICAgICAgICAgICByZXR1cm47CisKKyAgICAgICAgaWYgKHByaW1pdGl2ZVZhbHVlLT5nZXRJ ZGVudCgpID09IENTU1ZhbHVlTm9uZSkgewogICAgICAgICAgICAgbV9zdHlsZS0+c2V0UGVyc3Bl Y3RpdmUoMCk7CiAgICAgICAgICAgICByZXR1cm47CiAgICAgICAgIH0K