Bug 216659 – Crash in FontCascade::fontMetrics

• Component: CSS
• Status: RESOLVED FIXED

[Ali Juma]

Created attachment 409055 [details]
Minimized test case

Filing this as a security bug since it was found using a fuzzer; there's no disclosure deadline for this bug.

Crash stack:
=================================================================
==97273==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000060 (pc 0x000110d986f5 bp 0x7ffeec6f3e00 sp 0x7ffeec6f3dd0 T0)
==97273==The signal is caused by a READ memory access.
==97273==Hint: address points to the zero page.
==97273==WARNING: invalid path to external symbolizer!
==97273==WARNING: Failed to use and restart external symbolizer!
    #0 0x110d986f4 in WebCore::FontCascadeFonts::primaryFont(WebCore::FontCascadeDescription const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1966f4)
    #1 0x114684178 in WebCore::FontCascade::fontMetrics() const (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a82178)
    #2 0x113bfe974 in WebCore::CSSPrimitiveValue::computeNonCalcLengthDouble(WebCore::CSSToLengthConversionData const&, WebCore::CSSUnitType, double) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2ffc974)
    #3 0x113b06e2b in WTF::Vector<double, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> WTF::Vector<WTF::Ref<WebCore::CSSCalcExpressionNode, WTF::DumbPtrTraits<WebCore::CSSCalcExpressionNode> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::map<WebCore::CSSCalcOperationNode::computeLengthPx(WebCore::CSSToLengthConversionData const&) const::$_1, double>(WebCore::CSSCalcOperationNode::computeLengthPx(WebCore::CSSToLengthConversionData const&) const::$_1) const (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f04e2b)
    #4 0x113b06c6d in WebCore::CSSCalcOperationNode::computeLengthPx(WebCore::CSSToLengthConversionData const&) const (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f04c6d)
    #5 0x113b0b73f in WebCore::CSSCalcValue::computeLengthPx(WebCore::CSSToLengthConversionData const&) const (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f0973f)
    #6 0x113bfe788 in float WebCore::CSSPrimitiveValue::computeLength<float>(WebCore::CSSToLengthConversionData const&) const (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2ffc788)
    #7 0x1129b7dc6 in WebCore::Style::BuilderConverter::convertSpacing(WebCore::Style::BuilderState&, WebCore::CSSValue const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1db5dc6)
    #8 0x112913c7c in WebCore::Style::BuilderCustom::applyValueLetterSpacing(WebCore::Style::BuilderState&, WebCore::CSSValue&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1d11c7c)
    #9 0x115ebc942 in WebCore::Style::Builder::applyProperty(WebCore::CSSPropertyID, WebCore::CSSValue&, WebCore::SelectorChecker::LinkMatchMask) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x52ba942)
    #10 0x115ec9c9b in WebCore::Style::Builder::applyCascadeProperty(WebCore::Style::PropertyCascade::Property const&)::'lambda'(WebCore::SelectorChecker::LinkMatchMask)::operator()(WebCore::SelectorChecker::LinkMatchMask) const (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x52c7c9b)
    #11 0x115ebcc49 in WebCore::Style::Builder::applyCascadeProperty(WebCore::Style::PropertyCascade::Property const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x52bac49)
    #12 0x115ebcdfe in void WebCore::Style::Builder::applyPropertiesImpl<(WebCore::Style::Builder::CustomPropertyCycleTracking)1>(int, int) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x52badfe)
    #13 0x115ebbcfb in WebCore::Style::Builder::applyHighPriorityProperties() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x52b9cfb)
    #14 0x115ef1e5e in WebCore::Style::Resolver::applyMatchedProperties(WebCore::Style::Resolver::State&, WebCore::Style::MatchResult const&, WebCore::Style::Resolver::UseMatchedDeclarationsCache) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x52efe5e)
    #15 0x115ef01cc in WebCore::Style::Resolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::SelectorFilter const*) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x52ee1cc)
    #16 0x115f1805f in WebCore::Style::TreeResolver::styleForElement(WebCore::Element&, WebCore::RenderStyle const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x531605f)
    #17 0x115f185f6 in WebCore::Style::TreeResolver::resolveElement(WebCore::Element&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x53165f6)
    #18 0x115f1ac06 in WebCore::Style::TreeResolver::resolveComposedTree() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5318c06)
    #19 0x115f1bf66 in WebCore::Style::TreeResolver::resolve() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5319f66)
    #20 0x113ea61f5 in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x32a41f5)
    #21 0x113ea715b in WebCore::Document::updateStyleIfNeeded() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x32a515b)
    #22 0x113ecc7a6 in WebCore::Document::finishedParsing() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x32ca7a6)
    #23 0x114797b7a in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3b95b7a)
    #24 0x114c3d6b8 in WebCore::DocumentWriter::end() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x403b6b8)
    #25 0x114c3c1cc in WebCore::DocumentLoader::finishedLoading() (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x403a1cc)
    #26 0x114c3bb33 in WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&, WebCore::NetworkLoadMetrics const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x4039b33)
    #27 0x114de82ff in WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x41e62ff)
    #28 0x114de418b in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*, WebCore::NetworkLoadMetrics const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x41e218b)
    #29 0x114d60ed7 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x415eed7)
    #30 0x1070400a6 in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x197e0a6)
    #31 0x107719216 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x2057216)
    #32 0x107718823 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x2056823)
    #33 0x10700417a in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x194217a)
    #34 0x105745f8e in IPC::Connection::dispatchMessage(IPC::Decoder&) (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x83f8e)
    #35 0x105746c08 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x84c08)
    #36 0x10574776d in IPC::Connection::dispatchOneIncomingMessage() (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x8576d)
    #37 0x12dc6aa0c in WTF::RunLoop::performWork() (/Users/ajuma/WebKit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc7a0c)
    #38 0x12dc6dd75 in WTF::RunLoop::performWork(void*) (/Users/ajuma/WebKit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xcad75)
    #39 0x7fff34b86d51 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x83d51)
    #40 0x7fff34b86cf0 in __CFRunLoopDoSource0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x83cf0)
    #41 0x7fff34b86b0a in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x83b0a)
    #42 0x7fff34b85839 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x82839)
    #43 0x7fff34b84e3d in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x81e3d)
    #44 0x7fff372201c7 in -[NSRunLoop(NSRunLoop) runMode:beforeDate:] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x601c7)
    #45 0x7fff372d2c6e in -[NSRunLoop(NSRunLoop) run] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x112c6e)
    #46 0x7fff6ee824e9 in _xpc_objc_main.cold.4 (/usr/lib/system/libxpc.dylib:x86_64+0x164e9)
    #47 0x7fff6ee8242f in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x1642f)
    #48 0x7fff6ee81f62 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0x15f62)
    #49 0x1060bfac4 in WebKit::XPCServiceMain(int, char const**) (/Users/ajuma/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x9fdac4)
    #50 0x7fff6ec34cc8 in start (/usr/lib/system/libdyld.dylib:x86_64+0x1acc8)

==97273==Register values:
rax = 0x0000100000000000  rbx = 0x0000000000000000  rcx = 0x00001c1e000034f2  rdx = 0x0000000000000000
rdi = 0x0000000000000000  rsi = 0x000060f00001a738  rbp = 0x00007ffeec6f3e00  rsp = 0x00007ffeec6f3dd0
 r8 = 0x0000200000000000   r9 = 0x00000fffffffffff  r10 = 0x0000000000000000  r11 = 0xffffffffffffffff
r12 = 0x000010000000000c  r13 = 0x00001fffdd8de7cc  r14 = 0x0000000000000060  r15 = 0x000060300016efb0

[Radar WebKit Bug Importer]

<rdar://problem/69087507>

[Frédéric Wang (:fredw)]

Created attachment 417528 [details]
Further reduction

This reduces to

      letter-spacing: -webkit-calc(1ex);
      text-rendering: geometricPrecision;

[Frédéric Wang (:fredw)]

Created attachment 417533 [details]
Patch

[Ryosuke Niwa]

I guess there is no security implication here?

[Frédéric Wang (:fredw)]

(In reply to Ryosuke Niwa from comment #4)
> I guess there is no security implication here?

So basically CSSPrimitiveValue::computeNonCalcLengthDouble may need to call conversionData.style()->fontMetrics() which will in turn calls FontCascade::primaryFont() and hits a null pointer m_fonts ; so I'm not a security expert but my understanding is that there is no way to exploit this.

[Ryosuke Niwa]

Comment on attachment 417533 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=417533&action=review

> Source/WebCore/style/StyleBuilderCustom.h:-657
> -    if (is<CSSPrimitiveValue>(value) && downcast<CSSPrimitiveValue>(value).isFontRelativeLength())

Okay, I was initially concerned that isFontRelativeLength will do out-of-bound memory access
in release builds but m_primitiveUnitType is a member of CSSValue so this should be fine.

[EWS]

Committed r271688: <https://trac.webkit.org/changeset/271688>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 417533 [details].