Bug 288536
| Summary: | Use SingleThreadWeakPtr for SVGResourcesMap::legacyResources | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Said Abou-Hallawa <sabouhallawa> |
| Component: | SVG | Assignee: | Said Abou-Hallawa <sabouhallawa> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | sabouhallawa, webkit-bug-importer, zimmermann |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Said Abou-Hallawa
This HashMap maps from an `AtomString` to a raw pointer `LegacyRenderSVGResourceContainer*`. This can lead to all sorts of bad memory access bugs: UAF and null pointer dereferencing. In RenderLayer::setupClipPath(), we request a pointer to the SVG resource given the clip-path URI. The code path in RenderLayer from CSS property to the SVG resource is little bit trickier than referencing the SVG resources from the SVG renderers.
To protect this code path, we can make SVGResourcesMap::legacyResources map from `AtomString` to `SingleThreadWeakPtr<LegacyRenderSVGResourceContainer>`.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Said Abou-Hallawa
rdar://145361009
Said Abou-Hallawa
Pull request: https://github.com/WebKit/WebKit/pull/41334
EWS
Committed 291085@main (c6ebbb101667): <https://commits.webkit.org/291085@main>
Reviewed commits have been landed. Closing PR #41334 and removing active labels.
EWS
Committed 289651.192@safari-7621-branch (974f520eaa6c): <https://commits.webkit.org/289651.192@safari-7621-branch>
Reviewed commits have been landed. Closing PR #2688 and removing active labels.