| Summary: | null ptr deref with large background and -webkit-filter | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> | ||||||||
| Component: | CSS | Assignee: | Rob Buis <rbuis> | ||||||||
| Status: | RESOLVED FIXED | ||||||||||
| Severity: | Normal | CC: | bfulgham, cgarcia, dino, ews-feeder, gpoo, product-security, rbuis, sabouhallawa, simon.fraser, svillar, thorton, webkit-bug-importer, youennf | ||||||||
| Priority: | P2 | Keywords: | InRadar | ||||||||
| Version: | WebKit Nightly Build | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Ryosuke Niwa
2021-01-05 22:32:44 PST
This is easy to fix, will make a complete patch later:
--- a/Source/WebCore/css/CSSFilterImageValue.cpp
+++ b/Source/WebCore/css/CSSFilterImageValue.cpp
@@ -131,7 +131,10 @@ RefPtr<Image> CSSFilterImageValue::image(RenderElement& renderer, const FloatSiz
return &Image::nullImage();
cssFilter->apply();
- return cssFilter->output()->copyImage();
+ if (auto* output = cssFilter->output())
+ return output->copyImage();
+
+ return &Image::nullImage();
}
It does not seem like a security problem to me.
Created attachment 417354 [details]
Patch
Comment on attachment 417354 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=417354&action=review > Source/WebCore/css/CSSFilterImageValue.cpp:137 > + if (auto* output = cssFilter->output()) > + return output->copyImage(); > + > + return &Image::nullImage(); Please flip the condition so that returning nullImage when output is null will be an early exist and the normal flow of control when it's not null continues forward (i.e. output->copyImage() will be the last line of code). Created attachment 417437 [details]
Patch
Committed r271392: <https://trac.webkit.org/changeset/271392> All reviewed patches have been landed. Closing bug and clearing flags on attachment 417437 [details]. |