[Webkit-unassigned] [Bug 217668] New: Null dereference in PDFPlugin::snapshot()
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Oct 13 14:15:52 PDT 2020
https://bugs.webkit.org/show_bug.cgi?id=217668
Bug ID: 217668
Summary: Null dereference in PDFPlugin::snapshot()
Product: WebKit
Version: WebKit Nightly Build
Hardware: Macintosh
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: PDF
Assignee: webkit-unassigned at lists.webkit.org
Reporter: julian_a_gonzalez at apple.com
Created attachment 411254
--> https://bugs.webkit.org/attachment.cgi?id=411254&action=review
Crash log
In PDFPlugin::snapshot(), it's possible to dereference nullptr:
RefPtr<ShareableBitmap> PDFPlugin::snapshot()
{
...
auto bitmap = ShareableBitmap::createShareable(backingStoreSize, { });
auto context = bitmap->createGraphicsContext();
if (!context)
return nullptr;
...
}
bitmap here can be nullptr, so it must be checked before use.
Attaching a crash log.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20201013/5e2c19dd/attachment.htm>
More information about the webkit-unassigned
mailing list