New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 668553 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Bad-cast to blink::LayoutBox from blink::LayoutBR;blink::PaintLayer::setNeedsCompositingInputsUpdate;blink::RootScrollerController::recomputeEffectiveRootScroller

Project Member Reported by ClusterFuzz, Nov 24 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5432883591512064

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7f493b747508
Crash State:
  Bad-cast to blink::LayoutBox from blink::LayoutBR
  blink::PaintLayer::setNeedsCompositingInputsUpdate
  blink::RootScrollerController::recomputeEffectiveRootScroller
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=434312:434364

Minimized Testcase (3.09 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97OYWNjZQW1bfSNGSQdzPWYqByZ-8_sjVsEUXJAPTMTPtCSvHLbjFjFB8c2INIhQYTVJ1K0THR2kySUzwmwKCOeT4neHqdMsXbCYW1NPVpSRlE675C80sLzy0FPotlf6nNo5l2sMxB9kfCAJD3MHsSfSkwFuQ?testcase_id=5432883591512064

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msten...@opera.com e...@chromium.org
Components: Blink>Layout
Owner: dgro...@chromium.org
Status: Assigned (was: Untriaged)
Hi Layout folks, could you please take a look at this? Thanks!

Comment 2 by msten...@opera.com, Nov 25 2016

Cc: dgro...@chromium.org
Owner: msten...@opera.com
(need to steal this bug to gain access to the report)

Comment 3 by msten...@opera.com, Nov 25 2016

Document::documentElement() returns an HTMLBRElement, and the root scroller uses this as its effective root scroller (and assumes that it's LayoutBox or better, which sounds reasonable - I think the CSS spec requires that it be a block). Now, how can document.documentElement become a BR?

Comment 4 by msten...@opera.com, Nov 25 2016

Cc: yosin@chromium.org
Editing seems relevant.

Comment 5 by msten...@opera.com, Nov 25 2016

Owner: bokan@chromium.org
Editing does indeed trigger the crash (but it's possible to cause the same problem without it).

At some point, the document is left with a BR element and nothing else (no HTML root, no BODY). The BR element becomes document.documentRoot and it also becomes the root scroller. The BR element doesn't have a layout object at this point, because it wouldn't be a LayoutBox (but rather LayoutBR), and LayoutView refuses to accept the child when reattaching the tree.

Then Editor::tidyUpHTMLStructure() repairs the document, by wrapping the BR inside <html><body>. Then the BR creates a LayoutBR. We get another layout pass. The root scroller is still the BR element, though (missing update here?). If we get a call to RootScrollerController::rootScrollerPaintLayer() before the root scroller is updated to the HTML root, we'll crash.

It's possible to do this without editing, though. Attaching test case.

If we really should allow a BR to be a document root, this needs to be fixed in the scrolling code.
tc.html
543 bytes View Download
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 25 2016

Labels: M-56
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 25 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 25 2016

Labels: Pri-1

Comment 9 by bokan@chromium.org, Nov 25 2016

Thanks for the detailed analysis. Looks to me like a series of bugs:

1) rootScroller should never accept an element without a LayoutBox

2) rootScroller isn't updated after the layout pass with the repaired document

3) My gut feeling is that we shouldn't be returning <br> as the documentElement, that seems wrong and I wouldn't be surprised if it violates assumptions elsewhere.

I'll look to fix #1 so we can fix the security regression in M56. 2 and 3 I'll fix separately once the immediate issue is fixed.

Comment 10 by bokan@chromium.org, Nov 28 2016

I have a fix up at https://codereview.chromium.org/2531343002 for #1

#2 is actually working fine, the issue was *while* the root scroller was updating, it was assuming the *old* root scroller was a Box. Fixing #1 means the root scroller is appropriately updated.

I think #3 is actually seems intentional and changing it could have wide ranging implications so I'm going to leave it alone.
Project Member

Comment 11 by bugdroid1@chromium.org, Nov 28 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1a413b53d66a15908a7960fe1d7a3dc3c70a8a5e

commit 1a413b53d66a15908a7960fe1d7a3dc3c70a8a5e
Author: bokan <bokan@chromium.org>
Date: Mon Nov 28 23:27:34 2016

Don't assume current root scroller is a LayoutBox.

There was an edge case here where we might get an arbitrary element as the
document.documentElement. In these cases, the element won't get a LayoutObject
as LayoutView will refuse to attach to it, but when we replace it a layout will
create a non-LayoutBox for it and when RootScroller tries to replace it as the
effective root scroller it needs to do some book keeping using the old root
scroller. It incorrectly assumed it must be a LayoutBox.

This patch now guards against this edge case.

BUG= 668553 

Review-Url: https://codereview.chromium.org/2531343002
Cr-Commit-Position: refs/heads/master@{#434771}

[modify] https://crrev.com/1a413b53d66a15908a7960fe1d7a3dc3c70a8a5e/third_party/WebKit/Source/core/page/scrolling/RootScrollerUtil.cpp
[modify] https://crrev.com/1a413b53d66a15908a7960fe1d7a3dc3c70a8a5e/third_party/WebKit/Source/web/tests/RootScrollerTest.cpp

Comment 12 by bokan@chromium.org, Nov 28 2016

Labels: Merge-Request-56
Project Member

Comment 13 by ClusterFuzz, Nov 29 2016

ClusterFuzz has detected this issue as fixed in range 434723:434847.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5432883591512064

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7f493b747508
Crash State:
  Bad-cast to blink::LayoutBox from blink::LayoutBR
  blink::PaintLayer::setNeedsCompositingInputsUpdate
  blink::RootScrollerController::recomputeEffectiveRootScroller
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=434312:434364
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=434723:434847

Minimized Testcase (3.09 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97OYWNjZQW1bfSNGSQdzPWYqByZ-8_sjVsEUXJAPTMTPtCSvHLbjFjFB8c2INIhQYTVJ1K0THR2kySUzwmwKCOeT4neHqdMsXbCYW1NPVpSRlE675C80sLzy0FPotlf6nNo5l2sMxB9kfCAJD3MHsSfSkwFuQ?testcase_id=5432883591512064

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 14 by ClusterFuzz, Nov 29 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 15 by sheriffbot@chromium.org, Nov 29 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify

Comment 16 by bokan@chromium.org, Nov 29 2016

Status: Assigned (was: Verified)
Reopening as this still needs a merge into 56.

Comment 17 by dimu@chromium.org, Nov 29 2016

Labels: -Merge-Request-56 Merge-Approved-56 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M56 (branch: 2924)

Comment 18 by bokan@chromium.org, Nov 30 2016

Labels: -Merge-Approved-56
Status: Fixed (was: Assigned)
Sorry, this is actually fine in M56 as the bug was introduced by https://codereview.chromium.org/2499853002 which was after branch.
Labels: -ReleaseBlock-Beta -M-56 -Hotlist-Merge-Approved M-57
Project Member

Comment 20 by sheriffbot@chromium.org, Mar 8 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment