Crash in ASCIICaseInsensitiveHash::hash() when a response has a null MIME type
authoraestes@apple.com <aestes@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 19 Oct 2016 20:30:27 +0000 (20:30 +0000)
committeraestes@apple.com <aestes@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 19 Oct 2016 20:30:27 +0000 (20:30 +0000)
https://bugs.webkit.org/show_bug.cgi?id=163476
<rdar://problem/26941395>

Reviewed by Andreas Kling.

Source/WebKit2:

When custom content providers are registered and a response has a null MIME type, WebPage
will pass a null String to HashSet::contains(). This results in a null pointer dereference,
since the String hash functions do not support null Strings and unconditionally dereference
their StringImpls. Fixed by checking that Strings are non-null before calling
HashSet::contains() on m_mimeTypesWithCustomContentProviders.

New API test: WebKit2.LoadDataWithNilMIMEType.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::shouldUseCustomContentProviderForResponse): Checked if mimeType is null
before calling m_mimeTypesWithCustomContentProviders.contains().
(WebKit::WebPage::canShowMIMEType): Ditto.
* WebProcess/WebPage/WebPage.h: Made private the declaration of canPluginHandleResponse().

Tools:

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKit2Cocoa/LoadDataWithNilMIMEType.mm: Added.
(TEST): Added an API test that passes a nil MIMEType to
-[WKWebView loadData:MIMEType:characterEncodingName:baseURL:].

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@207563 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit2/ChangeLog
Source/WebKit2/WebProcess/WebPage/WebPage.cpp
Source/WebKit2/WebProcess/WebPage/WebPage.h
Tools/ChangeLog
Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
Tools/TestWebKitAPI/Tests/WebKit2Cocoa/LoadDataWithNilMIMEType.mm [new file with mode: 0644]

index 0e53a6c..a06c03c 100644 (file)
@@ -1,3 +1,25 @@
+2016-10-19  Andy Estes  <aestes@apple.com>
+
+        Crash in ASCIICaseInsensitiveHash::hash() when a response has a null MIME type
+        https://bugs.webkit.org/show_bug.cgi?id=163476
+        <rdar://problem/26941395>
+
+        Reviewed by Andreas Kling.
+
+        When custom content providers are registered and a response has a null MIME type, WebPage
+        will pass a null String to HashSet::contains(). This results in a null pointer dereference,
+        since the String hash functions do not support null Strings and unconditionally dereference
+        their StringImpls. Fixed by checking that Strings are non-null before calling
+        HashSet::contains() on m_mimeTypesWithCustomContentProviders.
+
+        New API test: WebKit2.LoadDataWithNilMIMEType.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::shouldUseCustomContentProviderForResponse): Checked if mimeType is null
+        before calling m_mimeTypesWithCustomContentProviders.contains().
+        (WebKit::WebPage::canShowMIMEType): Ditto.
+        * WebProcess/WebPage/WebPage.h: Made private the declaration of canPluginHandleResponse().
+
 2016-10-19  Chris Dumez  <cdumez@apple.com>
 
         Move HTML Interactive Form Validation behind an experimental flag
index 63466f0..1311f75 100644 (file)
@@ -4599,8 +4599,13 @@ bool WebPage::canPluginHandleResponse(const ResourceResponse& response)
 
 bool WebPage::shouldUseCustomContentProviderForResponse(const ResourceResponse& response)
 {
+    auto& mimeType = response.mimeType();
+    if (mimeType.isNull())
+        return false;
+
     // If a plug-in exists that claims to support this response, it should take precedence over the custom content provider.
-    return m_mimeTypesWithCustomContentProviders.contains(response.mimeType()) && !canPluginHandleResponse(response);
+    // canPluginHandleResponse() is called last because it performs synchronous IPC.
+    return m_mimeTypesWithCustomContentProviders.contains(mimeType) && !canPluginHandleResponse(response);
 }
 
 #if PLATFORM(COCOA)
@@ -5025,7 +5030,7 @@ bool WebPage::canShowMIMEType(const String& MIMEType) const
     if (MIMETypeRegistry::canShowMIMEType(MIMEType))
         return true;
 
-    if (m_mimeTypesWithCustomContentProviders.contains(MIMEType))
+    if (!MIMEType.isNull() && m_mimeTypesWithCustomContentProviders.contains(MIMEType))
         return true;
 
     const PluginData& pluginData = m_page->pluginData();
index b7e8f93..2d56dca 100644 (file)
@@ -845,7 +845,6 @@ public:
 #endif
 
     bool shouldUseCustomContentProviderForResponse(const WebCore::ResourceResponse&);
-    bool canPluginHandleResponse(const WebCore::ResourceResponse& response);
 
     bool asynchronousPluginInitializationEnabled() const { return m_asynchronousPluginInitializationEnabled; }
     void setAsynchronousPluginInitializationEnabled(bool enabled) { m_asynchronousPluginInitializationEnabled = enabled; }
@@ -1227,6 +1226,8 @@ private:
     void setResourceCachingDisabled(bool);
     void setUserInterfaceLayoutDirection(uint32_t);
 
+    bool canPluginHandleResponse(const WebCore::ResourceResponse&);
+
     uint64_t m_pageID;
 
     std::unique_ptr<WebCore::Page> m_page;
index 7c20aeb..7463b4c 100644 (file)
@@ -1,3 +1,16 @@
+2016-10-19  Andy Estes  <aestes@apple.com>
+
+        Crash in ASCIICaseInsensitiveHash::hash() when a response has a null MIME type
+        https://bugs.webkit.org/show_bug.cgi?id=163476
+        <rdar://problem/26941395>
+
+        Reviewed by Andreas Kling.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WebKit2Cocoa/LoadDataWithNilMIMEType.mm: Added.
+        (TEST): Added an API test that passes a nil MIMEType to
+        -[WKWebView loadData:MIMEType:characterEncodingName:baseURL:].
+
 2016-10-19  Jer Noble  <jer.noble@apple.com>
 
         Modify testrunner to mute audio during tests
index 6619150..4c26a5f 100644 (file)
                9B4F8FA7159D52DD002D9F94 /* HTMLCollectionNamedItem.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9B4F8FA6159D52CA002D9F94 /* HTMLCollectionNamedItem.html */; };
                9C64DC321D76198A004B598E /* YouTubePluginReplacement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9C64DC311D76198A004B598E /* YouTubePluginReplacement.cpp */; };
                A1146A8D1D2D7115000FE710 /* ContentFiltering.mm in Sources */ = {isa = PBXBuildFile; fileRef = A1146A8A1D2D704F000FE710 /* ContentFiltering.mm */; };
+               A125478F1DB18B9400358564 /* LoadDataWithNilMIMEType.mm in Sources */ = {isa = PBXBuildFile; fileRef = A125478D1DB18B9400358564 /* LoadDataWithNilMIMEType.mm */; };
                A13EBBAA1B87428D00097110 /* WebProcessPlugIn.mm in Sources */ = {isa = PBXBuildFile; fileRef = A13EBBA91B87428D00097110 /* WebProcessPlugIn.mm */; };
                A13EBBAB1B87434600097110 /* PlatformUtilitiesCocoa.mm in Sources */ = {isa = PBXBuildFile; fileRef = 0F139E721A423A2B00F590F5 /* PlatformUtilitiesCocoa.mm */; };
                A13EBBB01B87436F00097110 /* BundleParametersPlugIn.mm in Sources */ = {isa = PBXBuildFile; fileRef = A13EBBAE1B87436F00097110 /* BundleParametersPlugIn.mm */; };
                9B79164F1BD89D0D00D50B8F /* FirstResponderScrollingPosition.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FirstResponderScrollingPosition.mm; sourceTree = "<group>"; };
                9C64DC311D76198A004B598E /* YouTubePluginReplacement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = YouTubePluginReplacement.cpp; sourceTree = "<group>"; };
                A1146A8A1D2D704F000FE710 /* ContentFiltering.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ContentFiltering.mm; sourceTree = "<group>"; };
+               A125478D1DB18B9400358564 /* LoadDataWithNilMIMEType.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LoadDataWithNilMIMEType.mm; sourceTree = "<group>"; };
                A13EBB491B87339E00097110 /* TestWebKitAPI.wkbundle */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = TestWebKitAPI.wkbundle; sourceTree = BUILT_PRODUCTS_DIR; };
                A13EBB521B87346600097110 /* WebProcessPlugIn.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = WebProcessPlugIn.xcconfig; sourceTree = "<group>"; };
                A13EBB541B8734E000097110 /* Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
                                7C417F311D19E14800B8EF53 /* WKWebViewDefaultNavigationDelegate.mm */,
                                0F3B94A51A77266C00DE3272 /* WKWebViewEvaluateJavaScript.mm */,
                                9984FACA1CFFAEEE008D198C /* WKWebViewTextInput.mm */,
+                               A125478D1DB18B9400358564 /* LoadDataWithNilMIMEType.mm */,
                        );
                        name = "WebKit2 Cocoa";
                        path = WebKit2Cocoa;
                                37B47E301D64E7CA005F4EFF /* WKObject.mm in Sources */,
                                7CCE7EC01A411A7E00447C4C /* FragmentNavigation.mm in Sources */,
                                7CCE7EF61A411AE600447C4C /* FrameMIMETypeHTML.cpp in Sources */,
+                               A125478F1DB18B9400358564 /* LoadDataWithNilMIMEType.mm in Sources */,
                                7CCE7EF71A411AE600447C4C /* FrameMIMETypePNG.cpp in Sources */,
                                7C83E0BD1D0A650C00FEBCF3 /* FullscreenTopContentInset.mm in Sources */,
                                CDBFCC451A9FF45300A7B691 /* FullscreenZoomInitialFrame.mm in Sources */,
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2Cocoa/LoadDataWithNilMIMEType.mm b/Tools/TestWebKitAPI/Tests/WebKit2Cocoa/LoadDataWithNilMIMEType.mm
new file mode 100644 (file)
index 0000000..d44d4fb
--- /dev/null
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+
+#if WK_API_ENABLED
+
+#import "TestNavigationDelegate.h"
+#import <WebKit/WebKit.h>
+#import <wtf/RetainPtr.h>
+
+TEST(WebKit2, LoadDataWithNilMIMEType)
+{
+    auto webView = adoptNS([[WKWebView alloc] initWithFrame:NSZeroRect]);
+    NSString *mimeType = nil;
+    [webView loadData:[@"test" dataUsingEncoding:NSUTF8StringEncoding] MIMEType:mimeType characterEncodingName:@"UTF-8" baseURL:[NSURL URLWithString:@"about:blank"]];
+    [webView _test_waitForDidFinishNavigation];
+}
+
+#endif // WK_API_ENABLED