- Revision
- 223228
- Author
- [email protected]
- Date
- 2017-10-11 20:01:19 -0700 (Wed, 11 Oct 2017)
Log Message
Correct nullptr deref in selection handling.
https://bugs.webkit.org/show_bug.cgi?id=178189
<rdar://problem/33833012>
Reviewed by Ryosuke Niwa.
The VisibleSelection::toNormalizedRange returns nullptr for certain conditions (e.g., 'isNone'
and 'isOrphaned' cases). It's possible to crash the WebProcess by executing a code path with
an orphaned selection range.
The return value of 'toNormalizedRange' is checked for nullptr in many places, but not everywhere.
This patch adds those missing nullptr checks.
* accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper textMarkerRangeForSelection]):
* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
* editing/EditingStyle.cpp:
(WebCore::EditingStyle::styleAtSelectionStart):
* editing/Editor.cpp:
(WebCore::Editor::misspelledWordAtCaretOrRange const):
* page/DOMSelection.cpp:
(WebCore::DOMSelection::containsNode const):
* page/DragController.cpp:
(WebCore::DragController::concludeEditDrag):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (223227 => 223228)
--- trunk/Source/WebCore/ChangeLog 2017-10-12 01:35:40 UTC (rev 223227)
+++ trunk/Source/WebCore/ChangeLog 2017-10-12 03:01:19 UTC (rev 223228)
@@ -1,3 +1,31 @@
+2017-10-11 Brent Fulgham <[email protected]>
+
+ Correct nullptr deref in selection handling.
+ https://bugs.webkit.org/show_bug.cgi?id=178189
+ <rdar://problem/33833012>
+
+ Reviewed by Ryosuke Niwa.
+
+ The VisibleSelection::toNormalizedRange returns nullptr for certain conditions (e.g., 'isNone'
+ and 'isOrphaned' cases). It's possible to crash the WebProcess by executing a code path with
+ an orphaned selection range.
+
+ The return value of 'toNormalizedRange' is checked for nullptr in many places, but not everywhere.
+ This patch adds those missing nullptr checks.
+
+ * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+ (-[WebAccessibilityObjectWrapper textMarkerRangeForSelection]):
+ * editing/DeleteSelectionCommand.cpp:
+ (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
+ * editing/EditingStyle.cpp:
+ (WebCore::EditingStyle::styleAtSelectionStart):
+ * editing/Editor.cpp:
+ (WebCore::Editor::misspelledWordAtCaretOrRange const):
+ * page/DOMSelection.cpp:
+ (WebCore::DOMSelection::containsNode const):
+ * page/DragController.cpp:
+ (WebCore::DragController::concludeEditDrag):
+
2017-10-11 Ryan Haddad <[email protected]>
Unreviewed, rolling out r223215.
Modified: trunk/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm (223227 => 223228)
--- trunk/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm 2017-10-12 01:35:40 UTC (rev 223227)
+++ trunk/Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm 2017-10-12 03:01:19 UTC (rev 223228)
@@ -2449,6 +2449,9 @@
return nil;
RefPtr<Range> range = selection.toNormalizedRange();
+ if (!range)
+ return nil;
+
CharacterOffset start = cache->startOrEndCharacterOffsetForRange(range, true);
CharacterOffset end = cache->startOrEndCharacterOffsetForRange(range, false);
Modified: trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp (223227 => 223228)
--- trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp 2017-10-12 01:35:40 UTC (rev 223227)
+++ trunk/Source/WebCore/editing/DeleteSelectionCommand.cpp 2017-10-12 03:01:19 UTC (rev 223228)
@@ -461,7 +461,7 @@
void DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss()
{
RefPtr<Range> range = m_selectionToDelete.toNormalizedRange();
- RefPtr<Node> node = range->firstNode();
+ RefPtr<Node> node = range ? range->firstNode() : nullptr;
while (node && node != range->pastLastNode()) {
RefPtr<Node> nextNode = NodeTraversal::next(*node);
if ((is<HTMLStyleElement>(*node) && !downcast<HTMLStyleElement>(*node).hasAttributeWithoutSynchronization(scopedAttr)) || is<HTMLLinkElement>(*node)) {
Modified: trunk/Source/WebCore/editing/EditingStyle.cpp (223227 => 223228)
--- trunk/Source/WebCore/editing/EditingStyle.cpp 2017-10-12 01:35:40 UTC (rev 223227)
+++ trunk/Source/WebCore/editing/EditingStyle.cpp 2017-10-12 03:01:19 UTC (rev 223228)
@@ -1445,9 +1445,10 @@
// Also, if the selection is a range, ignore the background color at the start of selection,
// and find the background color of the common ancestor.
if (shouldUseBackgroundColorInEffect && (selection.isRange() || hasTransparentBackgroundColor(style->m_mutableStyle.get()))) {
- RefPtr<Range> range(selection.toNormalizedRange());
- if (auto value = backgroundColorInEffect(range->commonAncestorContainer()))
- style->setProperty(CSSPropertyBackgroundColor, value->cssText());
+ if (auto range = selection.toNormalizedRange()) {
+ if (auto value = backgroundColorInEffect(range->commonAncestorContainer()))
+ style->setProperty(CSSPropertyBackgroundColor, value->cssText());
+ }
}
return WTFMove(style);
Modified: trunk/Source/WebCore/editing/Editor.cpp (223227 => 223228)
--- trunk/Source/WebCore/editing/Editor.cpp 2017-10-12 01:35:40 UTC (rev 223227)
+++ trunk/Source/WebCore/editing/Editor.cpp 2017-10-12 03:01:19 UTC (rev 223228)
@@ -2180,6 +2180,8 @@
VisibleSelection wordSelection(selection.base());
wordSelection.expandUsingGranularity(WordGranularity);
RefPtr<Range> wordRange = wordSelection.toNormalizedRange();
+ if (!wordRange)
+ return String();
// In compliance with GTK+ applications, additionally allow to provide suggestions when the current
// selection exactly match the word selection.
Modified: trunk/Source/WebCore/page/DOMSelection.cpp (223227 => 223228)
--- trunk/Source/WebCore/page/DOMSelection.cpp 2017-10-12 01:35:40 UTC (rev 223227)
+++ trunk/Source/WebCore/page/DOMSelection.cpp 2017-10-12 03:01:19 UTC (rev 223228)
@@ -393,6 +393,8 @@
Ref<Node> protectedNode(node);
auto selectedRange = selection.selection().toNormalizedRange();
+ if (!selectedRange)
+ return false;
ContainerNode* parentNode = node.parentNode();
if (!parentNode || !parentNode->isConnected())
Modified: trunk/Source/WebCore/page/DragController.cpp (223227 => 223228)
--- trunk/Source/WebCore/page/DragController.cpp 2017-10-12 01:35:40 UTC (rev 223227)
+++ trunk/Source/WebCore/page/DragController.cpp 2017-10-12 03:01:19 UTC (rev 223228)
@@ -536,6 +536,8 @@
if (!color.isValid())
return false;
RefPtr<Range> innerRange = innerFrame->selection().toNormalizedRange();
+ if (!innerRange)
+ return false;
RefPtr<MutableStyleProperties> style = MutableStyleProperties::create();
style->setProperty(CSSPropertyColor, color.serialized(), false);
if (!innerFrame->editor().shouldApplyStyle(style.get(), innerRange.get()))
