AX:Null pointer may be dereferenced.

https://bugs.webkit.org/show_bug.cgi?id=120300

Patch by Lukasz Gajowy <l.gajowy@samsung.com> on 2013-08-28
Reviewed by Chris Fleizach.

Added a check if newObj is not null and an assert in order to avoid dereferecing null pointer.

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::getOrCreate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@154767 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index f3be9c75fadbbef9108f0180870121e431f1308a..d291cf8b46e3c7f4c08180f043763bb071c2a7fc 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2013-08-28  Lukasz Gajowy  <l.gajowy@samsung.com>
+
+        AX:Null pointer may be dereferenced.
+        https://bugs.webkit.org/show_bug.cgi?id=120300
+
+        Reviewed by Chris Fleizach.
+
+        Added a check if newObj is not null and an assert in order to avoid dereferecing null pointer.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+
 2013-08-28  Pratik Solanki  <psolanki@apple.com>
 
         Document::elementSheet() should return a reference

diff --git a/Source/WebCore/accessibility/AXObjectCache.cpp b/Source/WebCore/accessibility/AXObjectCache.cpp
index 9bd7ee61ee32b2dcd822b74e98b9371a46a2637b..ef8c09fade36b9c6dc47f05a515ff694364ab719 100644 (file)
--- a/Source/WebCore/accessibility/AXObjectCache.cpp
+++ b/Source/WebCore/accessibility/AXObjectCache.cpp
@@ -330,7 +330,12 @@ AccessibilityObject* AXObjectCache::getOrCreate(Widget* widget)
 
     // Will crash later if we have two objects for the same widget.
     ASSERT(!get(widget));
-        
+
+    // Catch the case if an (unsupported) widget type is used. Only FrameView and ScrollBar are supported now.
+    ASSERT(newObj);
+    if (!newObj)
+        return 0;
+
     getAXID(newObj.get());
     
     m_widgetObjectMapping.set(widget, newObj->axObjectID());