New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Sep 2010
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security
M-7

Restricted
  • Only users with EditIssue permission may comment.



Sign in to add a comment
link

Issue 56451: cross_fuzz: Deleted elements lingering in Document::m_elementsById

Reported by infe...@chromium.org, Sep 21 2010 Project Member

Issue description

@ap filed in webkit land-
https://bugs.webkit.org/show_bug.cgi?id=46222

@ap got a checkConsistency() assertion failure with cross_fuzz. This likely means an exploitable security issue, as he has seen in the past.

#0    0x1024820e9 in WTF::ValueCheck<WebCore::AtomicStringImpl*>::checkConsistency at ValueCheck.h:45
#1    0x102602c65 in WTF::HashTable<WebCore::AtomicStringImpl*, std::pair<WebCore::AtomicStringImpl*, WebCore::Element*>, WTF::PairFirstExtractor<std::pair<WebCore::AtomicStringImpl*, WebCore::Element*> >, WTF::PtrHash<WebCore::AtomicStringImpl*>, WTF::PairHashTraits<WTF::HashTraits<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::Element*> >, WTF::HashTraits<WebCore::AtomicStringImpl*> >::checkTableConsistencyExceptSize at HashTable.h:1025
#2    0x102602dd1 in WTF::HashTable<WebCore::AtomicStringImpl*, std::pair<WebCore::AtomicStringImpl*, WebCore::Element*>, WTF::PairFirstExtractor<std::pair<WebCore::AtomicStringImpl*, WebCore::Element*> >, WTF::PtrHash<WebCore::AtomicStringImpl*>, WTF::PairHashTraits<WTF::HashTraits<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::Element*> >, WTF::HashTraits<WebCore::AtomicStringImpl*> >::checkTableConsistency at HashTable.h:998
#3    0x102602e85 in WTF::HashMap<WebCore::AtomicStringImpl*, WebCore::Element*, WTF::PtrHash<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::AtomicStringImpl*>, WTF::HashTraits<WebCore::Element*> >::checkConsistency at HashMap.h:319
#4    0x1025da6f6 in WebCore::Document::getElementById at Document.cpp:909
#5    0x1025da8d2 in WebCore::Document::findAnchor at Document.cpp:4849
#6    0x102737f5f in WebCore::FrameView::scrollToAnchor at FrameView.cpp:970
#7    0x1027382b8 in WebCore::FrameView::scrollToFragment at FrameView.cpp:949
#8    0x102724a2e in WebCore::FrameLoader::loadInSameDocument at FrameLoader.cpp:1657
#9    0x102724cd4 in WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy at FrameLoader.cpp:3337
#10    0x102724d0c in WebCore::FrameLoader::callContinueFragmentScrollAfterNavigationPolicy at FrameLoader.cpp:3326
#11    0x102b78d63 in WebCore::PolicyCallback::call at PolicyCallback.cpp:101
#12    0x102b798b3 in WebCore::PolicyChecker::continueAfterNavigationPolicy at PolicyChecker.cpp:160
#13    0x101ea63db in WebFrameLoaderClient::receivedPolicyDecison at WebFrameLoaderClient.mm:1271
#14    0x101ea6470 in -[WebFramePolicyListener receivedPolicyDecision:] at WebFrameLoaderClient.mm:1864
...
 

Comment 1 by infe...@chromium.org, Sep 22 2010

Summary: cross_fuzz: Deleted elements lingering in Document::m_elementsById
Adam, since you reviewed @ap's patch for this on webkit land, do you see it as a risky merge for v7 or does it makes sense to hold it for 1st/2nd v7 patch or let it pick up in v8.

Comment 2 by infe...@chromium.org, Sep 22 2010

@ap says it is a medium risk merge and it is difficult to step on this issue.

Comment 3 by infe...@chromium.org, Sep 22 2010

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Status: WillMerge
@ap committed <http://trac.webkit.org/changeset/68096>.

Comment 4 by infe...@chromium.org, Oct 4 2010

Status: FixUnreleased
Merged to 517 in r69032.

Comment 5 by jsc...@chromium.org, Mar 21 2011

Labels: Type-Security

Comment 6 by jsc...@chromium.org, Oct 5 2011

Labels: SecImpacts-Stable
Batch update.

Comment 7 by jsc...@chromium.org, Apr 18 2012

Labels: -Restrict-View-SecurityNotify
Lifting view restrictions.

Comment 8 by jsc...@chromium.org, Apr 18 2012

Status: Fixed

Comment 9 by bugdroid1@chromium.org, Oct 13 2012

Project Member
Labels: Restrict-AddIssueComment-Commit
Owner: ----
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.

Comment 10 by bugdroid1@chromium.org, Mar 10 2013

Project Member
Labels: -Area-WebKit -SecSeverity-High -Mstone-7 -Type-Security -SecImpacts-Stable Cr-Content Security-Impact-Stable M-7 Type-Bug-Security Security-Severity-High

Comment 11 by bugdroid1@chromium.org, Mar 13 2013

Project Member
Labels: -Restrict-AddIssueComment-Commit Restrict-AddIssueComment-EditIssue

Comment 12 by bugdroid1@chromium.org, Mar 21 2013

Project Member
Labels: -Security-Severity-High Security_Severity-High

Comment 13 by bugdroid1@chromium.org, Mar 21 2013

Project Member
Labels: -Security-Impact-Stable Security_Impact-Stable

Comment 14 by bugdroid1@chromium.org, Apr 6 2013

Project Member
Labels: -Cr-Content Cr-Blink

Comment 15 by sheriffbot@chromium.org, Oct 1 2016

Project Member
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 16 by sheriffbot@chromium.org, Oct 2 2016

Project Member
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 17 by mbarbe...@chromium.org, Oct 2 2016

Labels: allpublic

Sign in to add a comment