[Webkit-unassigned] [Bug 146267] New: [GTK] Crash performing drag-and-drop

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=146267

            Bug ID: 146267
           Summary: [GTK] Crash performing drag-and-drop
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Gtk
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mcatanzaro at igalia.com

Created attachment 255454
  --> https://bugs.webkit.org/attachment.cgi?id=255454&action=review
backtrace

Try to drag and drop anything from the web view with GTK+ 3.17.2 or higher. The UI process will crash with the attached backtrace.

The problem is in WebKit::DragAndDropHandler::startDrag:

GUniquePtr<GdkEvent> currentEvent(gtk_get_current_event());

GdkDragContext* context = gtk_drag_begin(m_page.viewWidget(), targetList.get(), dragOperationToGdkDragActions(dragData.draggingSourceOperationMask()),
    GDK_BUTTON_PRIMARY, currentEvent.get());

gtk_get_current_event is nullable but the last parameter to gtk_drag_begin is not, so we should check to ensure it is not null here. This of course does not fix drag and drop, but it does fix the crash. Without this, the web process could force the UI process to crash by sending fake startDrag messages.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150624/67a471f6/attachment.html>