Changeset 209951 in webkit

Timestamp:

Dec 16, 2016 4:48:31 PM (7 years ago)

Author:

Alan Bujtas

Message:

Possible nullptr dereference when applying pagination to viewport
​https://bugs.webkit.org/show_bug.cgi?id=165926

Reviewed by Simon Fraser.

Static analysis found a code path where a null dereference could occur.

• page/FrameView.cpp:

(WebCore::FrameView::applyPaginationToViewport):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/FrameView.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-12-16  Zalan Bujtas  <zalan@apple.com>
+
+        Possible nullptr dereference when applying pagination to viewport
+        https://bugs.webkit.org/show_bug.cgi?id=165926
+
+        Reviewed by Simon Fraser.
+
+        Static analysis found a code path where a null dereference could occur.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::applyPaginationToViewport):
+
 2016-12-16  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/page/FrameView.cpp

@@ -748 +748 @@
 void FrameView::applyPaginationToViewport()
 {
-    Document* document = frame().document();
-    auto* documentElement = document->documentElement();
-    RenderElement* documentRenderer = documentElement ? documentElement->renderer() : nullptr;
-    RenderElement* documentOrBodyRenderer = documentRenderer;
+    auto* document = frame().document();
+    auto* documentElement = document ? document->documentElement() : nullptr;
+    if (!documentElement || !documentElement->renderer()) {
+        setPagination(Pagination());
+        return;
+    }
+
+    auto& documentRenderer = *documentElement->renderer();
+    auto* documentOrBodyRenderer = &documentRenderer;
+
     auto* body = document->body();
-    if (body && body->renderer())
-        documentOrBodyRenderer = documentRenderer->style().overflowX() == OVISIBLE && is<HTMLHtmlElement>(*documentElement) ? body->renderer() : documentRenderer;
+    if (body && body->renderer()) {
+        documentOrBodyRenderer = documentRenderer.style().overflowX() == OVISIBLE && is<HTMLHtmlElement>(*documentElement) ?
+            body->renderer() : &documentRenderer;
+    }
 
     Pagination pagination;
-
-    if (!documentOrBodyRenderer) {
-        setPagination(pagination);
-        return;
-    }
-
     EOverflow overflowY = documentOrBodyRenderer->style().overflowY();
     if (overflowY == OPAGEDX || overflowY == OPAGEDY) {
@@ -768 +770 @@
         pagination.gap = static_cast<unsigned>(documentOrBodyRenderer->style().columnGap());
     }
-
     setPagination(pagination);
 }