[Webkit-unassigned] [Bug 55597] New: Arbitrary script execution during style recalc due to SVG font instantiation firing pending image load events

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=55597

           Summary: Arbitrary script execution during style recalc due to
                    SVG font instantiation firing pending image load
                    events
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Keywords: NeedsRadar
          Severity: Normal
          Priority: P2
         Component: New Bugs
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: mitz at webkit.org
                CC: ap at webkit.org


During style recalc (or attach()), CachedFont::ensureSVGFontData() can be called, and in turn call into Document::setContent(). That does an implicitClose() which calls ImageLoader::dispatchPendingLoadEvents(), which dispatches an arbitrary set of event and can cause arbitrary script execution and re-entry into style and layout code.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.