Changeset 201571 in webkit

Timestamp:

Jun 1, 2016, 2:43:09 PM (10 years ago)

Author:

Chris Dumez

Message:

Crash under eventTargetRespectingTargetRules()
​https://bugs.webkit.org/show_bug.cgi?id=158273
<rdar://problem/26343998>

Reviewed by Alex Christensen.

The code would call nodeOrHostIfPseudoElement(), which can return null
and then dereference it in eventTargetRespectingTargetRules() without
null check. This patch adds a null check. When the node is null, the
while loop after will do nothing and thus the target will not be used.

No new tests, we do not have a good reproduction case.

• dom/EventPath.cpp:

(WebCore::EventPath::EventPath):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/EventPath.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-06-01  Chris Dumez  <cdumez@apple.com>
+
+        Crash under eventTargetRespectingTargetRules()
+        https://bugs.webkit.org/show_bug.cgi?id=158273
+        <rdar://problem/26343998>
+
+        Reviewed by Alex Christensen.
+
+        The code would call nodeOrHostIfPseudoElement(), which can return null
+        and then dereference it in eventTargetRespectingTargetRules() without
+        null check. This patch adds a null check. When the node is null, the
+        while loop after will do nothing and thus the target will not be used.
+
+        No new tests, we do not have a good reproduction case.
+
+        * dom/EventPath.cpp:
+        (WebCore::EventPath::EventPath):
+
 2016-06-01  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/dom/EventPath.cpp

@@ -92 +92 @@
 #endif
     Node* node = nodeOrHostIfPseudoElement(&originalTarget);
-    Node* target = eventTargetRespectingTargetRules(*node);
+    Node* target = node ? eventTargetRespectingTargetRules(*node) : nullptr;
     while (node) {
         while (node) {