Changeset 288308 in webkit


Ignore:
Timestamp:
Jan 20, 2022 11:08:25 AM (2 years ago)
Author:
Adrian Perez de Castro
Message:

Merge r288052 - null ptr deref in WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor()
​https://bugs.webkit.org/show_bug.cgi?id=233463

Patch by Frederic Wang <​fwang@igalia.com> on 2022-01-14
Reviewed by Wenson Hsieh.

Source/WebCore:

One line of ReplaceSelectionCommand::moveNodeOutOfAncestor() assumes that the pointer
ancestor.parentNode() is non-null. However, the call to removeNode(node) just before can
lead to arbitrary tree mutations that leaves the ancestor orphan, causing a nullptr deref.
This patch mitigates that issue by exiting early if that situation happens.

  • editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor): Exit early if the ancestor
is no longer connected.

LayoutTests:

Add non-regression test.

  • editing/execCommand/paste-as-quotation-disconnected-paragraph-ancestor-crash-expected.txt: Added.
  • editing/execCommand/paste-as-quotation-disconnected-paragraph-ancestor-crash.html: Added.
  • editing/execCommand/resources/paste-as-quotation-disconnected-paragraph-ancestor-crash-iframe.html: Added.
  • platform/win/TestExpectations: Skip test on windows, as the test seems to shift expectations with text output

of other execCommand tests.

Location:
releases/WebKitGTK/webkit-2.34
Files:
3 added
4 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.34/LayoutTests/ChangeLog

    r288292 r288308  
     12022-01-14  Frederic Wang  <fwang@igalia.com>
     2
     3        null ptr deref in WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor()
     4        https://bugs.webkit.org/show_bug.cgi?id=233463
     5
     6        Reviewed by Wenson Hsieh.
     7
     8        Add non-regression test.
     9
     10        * editing/execCommand/paste-as-quotation-disconnected-paragraph-ancestor-crash-expected.txt: Added.
     11        * editing/execCommand/paste-as-quotation-disconnected-paragraph-ancestor-crash.html: Added.
     12        * editing/execCommand/resources/paste-as-quotation-disconnected-paragraph-ancestor-crash-iframe.html: Added.
     13        * platform/win/TestExpectations: Skip test on windows, as the test seems to shift expectations with text output
     14        of other execCommand tests.
     15
    1162022-01-10  Alan Bujtas  <zalan@apple.com>
    217

  • releases/WebKitGTK/webkit-2.34/LayoutTests/platform/win/TestExpectations

    r281762 r288308  
    316316fast/overflow/scrollbar-restored-and-then-locked.html [ Skip ]
    317317
     318editing/execCommand/paste-as-quotation-disconnected-paragraph-ancestor-crash.html [ Skip ]
    318319storage/indexeddb/clone-exception.html [ Timeout ]
    319320storage/indexeddb/database-odd-names.html [ Timeout Failure ]

  • releases/WebKitGTK/webkit-2.34/Source/WebCore/ChangeLog

    r288292 r288308  
     12022-01-14  Frederic Wang  <fwang@igalia.com>
     2
     3        null ptr deref in WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor()
     4        https://bugs.webkit.org/show_bug.cgi?id=233463
     5
     6        Reviewed by Wenson Hsieh.
     7
     8        One line of ReplaceSelectionCommand::moveNodeOutOfAncestor() assumes that the pointer
     9        ancestor.parentNode() is non-null. However, the call to removeNode(node) just before can
     10        lead to arbitrary tree mutations that leaves the ancestor orphan, causing a nullptr deref.
     11        This patch mitigates that issue by exiting early if that situation happens.
     12
     13        * editing/ReplaceSelectionCommand.cpp:
     14        (WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor): Exit early if the ancestor
     15        is no longer connected.
     16
    1172022-01-10  Alan Bujtas  <zalan@apple.com>
    218

  • releases/WebKitGTK/webkit-2.34/Source/WebCore/editing/ReplaceSelectionCommand.cpp

    r281745 r288308  
    831831    if (positionAtEndOfNode == lastPositionInParagraph) {
    832832        removeNode(node);
     833        if (!ancestor.isConnected())
     834            return;
    833835        if (ancestor.nextSibling())
    834836            insertNodeBefore(WTFMove(protectedNode), *ancestor.nextSibling());
Note: See TracChangeset for help on using the changeset viewer.