Bug 234375

Summary:

null ptr deref in WebCore::findPlaceForCounter

Product:

WebKit

Reporter:

Gabriel Nava Marino <gnavamarino>

Component:

Layout and Rendering

Assignee:

Gabriel Nava Marino <gnavamarino>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bfulgham, changseok, esprehn+autocc, ews-watchlist, glenn, kondapallykalyan, pdr, simon.fraser, webkit-bug-importer, zalan

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none
Patch	none

Description Gabriel Nava Marino 2021-12-15 18:02:27 PST

Since parentOrPseudoHostElement can return a nullptr, we need to check for that before trying to access the renderer() of the Element object it returns.

Comment 1 Gabriel Nava Marino 2021-12-15 18:13:02 PST

<rdar://problem/86518846>

Comment 2 Gabriel Nava Marino 2021-12-15 18:14:38 PST

Created attachment 447305 [details]
Patch

Comment 3 zalan 2021-12-15 18:47:04 PST

Comment on attachment 447305 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=447305&action=review

> Source/WebCore/ChangeLog:11
> +        Since parentOrPseudoHostElement can return a nullptr, we need to check for nullptr before trying to
> +        access the renderer() of the Element pointer it returns.

Could you explain why parentOrPseudoHostElement() returns nullptr in here?

> Source/WebCore/rendering/RenderCounter.cpp:315
> +                        auto parent = parentOrPseudoHostElement(*currentRenderer);

I'd write it like auto* parent = parentOrPseudoHostElement(*currentRenderer);

Comment 4 Gabriel Nava Marino 2021-12-16 10:45:23 PST

Created attachment 447372 [details]
Patch

Comment 5 EWS 2021-12-17 10:03:59 PST

Committed r287194 (245361@main): <https://commits.webkit.org/245361@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 447372 [details].