New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 56451 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Sep 2010
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security
M-7

Restricted
  • Only users with EditIssue permission may comment.



Sign in to add a comment

cross_fuzz: Deleted elements lingering in Document::m_elementsById

Project Member Reported by infe...@chromium.org, Sep 21 2010

Issue description

@ap filed in webkit land-
https://bugs.webkit.org/show_bug.cgi?id=46222

@ap got a checkConsistency() assertion failure with cross_fuzz. This likely means an exploitable security issue, as he has seen in the past.

#0    0x1024820e9 in WTF::ValueCheck<WebCore::AtomicStringImpl*>::checkConsistency at ValueCheck.h:45
#1    0x102602c65 in WTF::HashTable<WebCore::AtomicStringImpl*, std::pair<WebCore::AtomicStringImpl*, WebCore::Element*>, WTF::PairFirstExtractor<std::pair<WebCore::AtomicStringImpl*, WebCore::Element*> >, WTF::PtrHash<WebCore::AtomicStringImpl*>, WTF::PairHashTraits<WTF::HashTraits<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::Element*> >, WTF::HashTraits<WebCore::AtomicStringImpl*> >::checkTableConsistencyExceptSize at HashTable.h:1025
#2    0x102602dd1 in WTF::HashTable<WebCore::AtomicStringImpl*, std::pair<WebCore::AtomicStringImpl*, WebCore::Element*>, WTF::PairFirstExtractor<std::pair<WebCore::AtomicStringImpl*, WebCore::Element*> >, WTF::PtrHash<WebCore::AtomicStringImpl*>, WTF::PairHashTraits<WTF::HashTraits<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::Element*> >, WTF::HashTraits<WebCore::AtomicStringImpl*> >::checkTableConsistency at HashTable.h:998
#3    0x102602e85 in WTF::HashMap<WebCore::AtomicStringImpl*, WebCore::Element*, WTF::PtrHash<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::Element*> >::checkConsistency at HashMap.h:319
#4    0x1025da6f6 in WebCore::Document::getElementById at Document.cpp:909
#5    0x1025da8d2 in WebCore::Document::findAnchor at Document.cpp:4849
#6    0x102737f5f in WebCore::FrameView::scrollToAnchor at FrameView.cpp:970
#7    0x1027382b8 in WebCore::FrameView::scrollToFragment at FrameView.cpp:949
#8    0x102724a2e in WebCore::FrameLoader::loadInSameDocument at FrameLoader.cpp:1657
#9    0x102724cd4 in WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy at FrameLoader.cpp:3337
#10    0x102724d0c in WebCore::FrameLoader::callContinueFragmentScrollAfterNavigationPolicy at FrameLoader.cpp:3326
#11    0x102b78d63 in WebCore::PolicyCallback::call at PolicyCallback.cpp:101
#12    0x102b798b3 in WebCore::PolicyChecker::continueAfterNavigationPolicy at PolicyChecker.cpp:160
#13    0x101ea63db in WebFrameLoaderClient::receivedPolicyDecison at WebFrameLoaderClient.mm:1271
#14    0x101ea6470 in -[WebFramePolicyListener receivedPolicyDecision:] at WebFrameLoaderClient.mm:1864
...


 
Summary: cross_fuzz: Deleted elements lingering in Document::m_elementsById
Adam, since you reviewed @ap's patch for this on webkit land, do you see it as a risky merge for v7 or does it makes sense to hold it for 1st/2nd v7 patch or let it pick up in v8.
@ap says it is a medium risk merge and it is difficult to step on this issue.
Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Status: WillMerge
@ap committed <http://trac.webkit.org/changeset/68096>.
Status: FixUnreleased
Merged to 517 in r69032.

Comment 5 by jsc...@chromium.org, Mar 21 2011

Labels: Type-Security
Labels: SecImpacts-Stable
Batch update.

Comment 7 by jsc...@chromium.org, Apr 18 2012

Labels: -Restrict-View-SecurityNotify
Lifting view restrictions.

Comment 8 by jsc...@chromium.org, Apr 18 2012

Status: Fixed
Project Member

Comment 9 by bugdroid1@chromium.org, Oct 13 2012

Labels: Restrict-AddIssueComment-Commit
Owner: ----
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.
Project Member

Comment 10 by bugdroid1@chromium.org, Mar 10 2013

Labels: -Area-WebKit -SecSeverity-High -Mstone-7 -Type-Security -SecImpacts-Stable Cr-Content Security-Impact-Stable M-7 Type-Bug-Security Security-Severity-High
Project Member

Comment 11 by bugdroid1@chromium.org, Mar 13 2013

Labels: -Restrict-AddIssueComment-Commit Restrict-AddIssueComment-EditIssue
Project Member

Comment 12 by bugdroid1@chromium.org, Mar 21 2013

Labels: -Security-Severity-High Security_Severity-High
Project Member

Comment 13 by bugdroid1@chromium.org, Mar 21 2013

Labels: -Security-Impact-Stable Security_Impact-Stable
Project Member

Comment 14 by bugdroid1@chromium.org, Apr 6 2013

Labels: -Cr-Content Cr-Blink
Project Member

Comment 15 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 16 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment