Bug 108931 - Crash when loading MHTML including malformed Content-Type
Summary: Crash when loading MHTML including malformed Content-Type
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-02-05 04:47 PST by KwangYong Choi
Modified: 2017-06-20 02:16 PDT (History)
11 users (show)

See Also:


Attachments
Patch (2.74 KB, patch)
2013-02-05 04:50 PST, KwangYong Choi
no flags Details | Formatted Diff | Diff
Patch (3.87 KB, patch)
2013-02-05 04:54 PST, KwangYong Choi
webkit.review.bot: commit-queue-
Details | Formatted Diff | Diff
Patch (4.58 KB, patch)
2013-02-05 07:09 PST, KwangYong Choi
no flags Details | Formatted Diff | Diff
Patch (3.59 KB, patch)
2013-02-06 01:34 PST, KwangYong Choi
no flags Details | Formatted Diff | Diff
Patch (4.18 KB, patch)
2013-02-06 01:59 PST, KwangYong Choi
buildbot: commit-queue-
Details | Formatted Diff | Diff
Patch (3.88 KB, patch)
2013-02-06 18:21 PST, KwangYong Choi
no flags Details | Formatted Diff | Diff
Patch (4.29 KB, patch)
2013-02-08 01:05 PST, KwangYong Choi
no flags Details | Formatted Diff | Diff
Patch (8.02 KB, patch)
2015-05-15 04:23 PDT, Csaba Osztrogonác
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description KwangYong Choi 2013-02-05 04:47:51 PST
MHTMLParser does not set main resource when it has malformed Content-Type. So, m_archive->mainResource() can be NULL.
Comment 1 KwangYong Choi 2013-02-05 04:50:34 PST
Created attachment 186601 [details]
Patch
Comment 2 KwangYong Choi 2013-02-05 04:54:04 PST
Created attachment 186602 [details]
Patch

Add missing files.
Comment 3 WebKit Review Bot 2013-02-05 05:37:06 PST
Comment on attachment 186602 [details]
Patch

Attachment 186602 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/16371745

New failing tests:
mhtml/page_with_malformed_content_type.mht
Comment 4 KwangYong Choi 2013-02-05 06:09:27 PST
May I add empty pixel expectation for this test? In this test, I can not make testRunner.dumpAsText() call.
Comment 5 KwangYong Choi 2013-02-05 07:09:42 PST
Created attachment 186620 [details]
Patch

Add pixel expectation.
Comment 6 Adam Barth 2013-02-06 00:22:47 PST
Comment on attachment 186620 [details]
Patch

Perhaps we can use a ref test?
Comment 7 KwangYong Choi 2013-02-06 01:13:35 PST
(In reply to comment #6)
> (From update of attachment 186620 [details])
> Perhaps we can use a ref test?

Thank you for your idea. May I use an empty html file for ref?
Comment 8 KwangYong Choi 2013-02-06 01:34:31 PST
Created attachment 186786 [details]
Patch
Comment 9 KwangYong Choi 2013-02-06 01:59:30 PST
Created attachment 186795 [details]
Patch
Comment 10 Build Bot 2013-02-06 03:24:51 PST
Comment on attachment 186795 [details]
Patch

Attachment 186795 [details] did not pass win-ews (win):
Output: http://queues.webkit.org/results/16396124
Comment 11 KwangYong Choi 2013-02-06 18:21:07 PST
Created attachment 186972 [details]
Patch

Re-upload patch again because of win-ews false alarm.
Comment 12 KwangYong Choi 2013-02-07 04:17:08 PST
(In reply to comment #11)
> Created an attachment (id=186972) [details]
> Patch
> 
> Re-upload patch again because of win-ews false alarm.

cr-android-ews :(
Comment 13 KwangYong Choi 2013-02-08 01:05:48 PST
Created attachment 187262 [details]
Patch
Comment 14 KwangYong Choi 2013-02-21 17:16:27 PST
Review?
Comment 15 Bem Jones-Bey 2014-04-17 16:23:42 PDT
Is this patch still needed?
Comment 16 Alexey Proskuryakov 2014-04-18 09:40:57 PDT
Seems like it's needed for MHTML support, but I'm not sure if any ports enable MHTML. Perhaps the whole feature should be removed?

ENABLE_MHTML is never seen in sources, but it's in Tools/Scripts/webkitperl/FeatureList.pm:

define => "ENABLE_MHTML", default => (isGtk() || isEfl()), value => \$mhtmlSupport },

What is this file used for? Does this mean that Gtk and Efl enable MHTML?
Comment 17 Bem Jones-Bey 2014-04-18 10:37:04 PDT
(In reply to comment #16)
> Seems like it's needed for MHTML support, but I'm not sure if any ports enable MHTML. Perhaps the whole feature should be removed?
> 
> ENABLE_MHTML is never seen in sources, but it's in Tools/Scripts/webkitperl/FeatureList.pm:
> 
> define => "ENABLE_MHTML", default => (isGtk() || isEfl()), value => \$mhtmlSupport },
> 
> What is this file used for? Does this mean that Gtk and Efl enable MHTML?

I'm not sure what that file is used for, but it is in some cmake build files as being turned on for EFL and Gtk:

Source/cmake/OptionsEfl.cmake
80:WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MHTML ON)

Source/cmake/OptionsGTK.cmake
52:WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MHTML ON)

But it doesn't answer if they're actually using it in practice.
Comment 18 Chris Dumez 2014-04-18 10:55:07 PDT
(In reply to comment #17)
> (In reply to comment #16)
> > Seems like it's needed for MHTML support, but I'm not sure if any ports enable MHTML. Perhaps the whole feature should be removed?
> > 
> > ENABLE_MHTML is never seen in sources, but it's in Tools/Scripts/webkitperl/FeatureList.pm:
> > 
> > define => "ENABLE_MHTML", default => (isGtk() || isEfl()), value => \$mhtmlSupport },
> > 
> > What is this file used for? Does this mean that Gtk and Efl enable MHTML?
> 
> I'm not sure what that file is used for, but it is in some cmake build files as being turned on for EFL and Gtk:
> 
> Source/cmake/OptionsEfl.cmake
> 80:WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MHTML ON)
> 
> Source/cmake/OptionsGTK.cmake
> 52:WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MHTML ON)
> 
> But it doesn't answer if they're actually using it in practice.

Gyuyoung should confirm but last I checked we were using MHTML. FYI, I believe I fixed this crash (and another one iirc) on Blink side:
https://src.chromium.org/viewvc/blink?view=rev&revision=164584
Comment 19 Chris Dumez 2014-09-11 16:57:39 PDT
Comment on attachment 187262 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=187262&action=review

> Source/WebCore/loader/DocumentLoader.cpp:498
>          return false;

If you clear m_archive here before returning, then you no longer need the fix in DocumentLoader::commitData(). See corresponding Blink fix:
https://src.chromium.org/viewvc/blink?revision=164584&view=revision
Comment 20 Csaba Osztrogonác 2015-05-15 04:23:35 PDT
Created attachment 253191 [details]
Patch
Comment 21 Darin Adler 2015-05-20 08:43:02 PDT
Comment on attachment 253191 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=253191&action=review

I am OK with this change, but I think we can do better.

> Source/WebCore/loader/DocumentLoader.cpp:970
> +    if (!m_archive || !m_archive->mainResource()) {

I suggest we make this fix inside ArchiveFactory::create. That function should never return an archive without a main resource. Further, the Archive class should be changed to have a reference for the main resource instead of a pointer. We don’t need to be able to create archives without main resources.