[Webkit-unassigned] [Bug 19537] New: DOM modification causes Access Violations (NULL pointers?)

Fri Jun 13 09:20:52 PDT 2008

https://bugs.webkit.org/show_bug.cgi?id=19537

           Summary: DOM modification causes Access Violations (NULL
                    pointers?)
           Product: WebKit
           Version: 525.x (Safari 3.1)
          Platform: PC
               URL: http://skypher.com/SkyLined/Repro/Safari/706b5eef%20or%2
                    06eb35eef%20NULL/repro.html
        OS/Version: Windows Vista
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: berendjanwever at gmail.com

I found that the following javascript causes two Access Violations. Both appear
to be NULL pointers:

<BODY onload="go()"><SCRIPT>
    function go() {
        document.body.parentElement.removeChild(document.body);
        oI=document.createElement('i');

oI.innerHTML='<frameSet></frameSet><u><code><dir><base></dir></code></u><frame></frame><code></code>';
    }
</SCRIPT></BODY>

One of the two AVs happens most often, I think which one happens is based on
timing. Please note that at least one of the NULL pointers happens in code that
appears to want to call a method in a vtable. Should the NULL value be attacker
controlable, this is extremely exploitable. I am assuming it is always NULL and
not exploitable.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.