Changeset 278398 in webkit

Timestamp:

Jun 3, 2021, 12:09:28 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in HTMLConverter::_addLinkForElement()
​https://bugs.webkit.org/show_bug.cgi?id=226398

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-06-03
Reviewed by Ryosuke Niwa.

Source/WebCore:

While traversing a node, exit an element with a startIndex
that is always inside the bounds of the attribute string.

Test: editing/pasteboard/select-all-link-cut.html

• editing/cocoa/HTMLConverter.mm:

(HTMLConverter::_traverseNode):

LayoutTests:

Add a test for this crasher.

• editing/pasteboard/select-all-link-cut-expected.txt: Added.
• editing/pasteboard/select-all-link-cut.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/editing/pasteboard/select-all-link-cut-expected.txt (added)
• LayoutTests/editing/pasteboard/select-all-link-cut.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/editing/cocoa/HTMLConverter.mm (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-06-03  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in HTMLConverter::_addLinkForElement()
+        https://bugs.webkit.org/show_bug.cgi?id=226398
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a test for this crasher.
+
+        * editing/pasteboard/select-all-link-cut-expected.txt: Added.
+        * editing/pasteboard/select-all-link-cut.html: Added.
+
 2021-06-02  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-06-03  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in HTMLConverter::_addLinkForElement()
+        https://bugs.webkit.org/show_bug.cgi?id=226398
+
+        Reviewed by Ryosuke Niwa.
+
+        While traversing a node, exit an element with a startIndex
+        that is always inside the bounds of the attribute string.
+
+        Test: editing/pasteboard/select-all-link-cut.html
+
+        * editing/cocoa/HTMLConverter.mm:
+        (HTMLConverter::_traverseNode):
+
 2021-06-02  Rob Buis  <rbuis@igalia.com>
 

trunk/Source/WebCore/editing/cocoa/HTMLConverter.mm

@@ -2217 +2217 @@
                     }
                 }
-                _exitElement(element, depth, startIndex);
+                _exitElement(element, depth, std::min(startIndex, [_attrStr length]));
             }
         }