Bug 178189 - Correct nullptr deref in selection handling
Summary: Correct nullptr deref in selection handling
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-10-11 15:39 PDT by Brent Fulgham
Modified: 2017-10-11 20:01 PDT (History)
4 users (show)

See Also:


Attachments
Patch (6.28 KB, patch)
2017-10-11 16:13 PDT, Brent Fulgham
rniwa: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2017-10-11 15:39:06 PDT
The 'Selection::toNormalizedRange()' returns nullptr for various conditions, specifically for a 'None' selection, but also for an "Orphaned" range.

We should make sure we check that 'toNormalizedRange' returns a non-null pointer before using it.
Comment 1 Brent Fulgham 2017-10-11 16:12:49 PDT
<rdar://problem/33833012>
Comment 2 Brent Fulgham 2017-10-11 16:13:40 PDT
Created attachment 323480 [details]
Patch
Comment 3 Ryosuke Niwa 2017-10-11 19:03:02 PDT
Comment on attachment 323480 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=323480&action=review

> Source/WebCore/page/DOMSelection.cpp:397
> +    auto visibleSelection = selection.selection();
> +    if (visibleSelection.isNoneOrOrphaned())
> +        return false;

There's no reason to check this condition if we're checking null-ty of toNormalizedRange. Please remove it.
Comment 4 Brent Fulgham 2017-10-11 20:01:22 PDT
Committed r223228: <https://trac.webkit.org/changeset/223228>