← WebKit — 2026-W36
f15a2f2705c4d3c658bdc35936b8834eaf4da056 [list-marker] RenderListItem should answer for its marker instead of its callers consulting RenderListMarker
severity medium
class UAF
confidence 0.6
signal score 9.06
Source/WebCore/rendering
patch-now
Primitive: listMarkerTextForNodeAndPosition returned a StringView into a temporary/local marker-text String, producing a dangling view read after the backing String was destroyed.
Triage note: Changes lineStartListMarkerText/listMarkerTextForNodeAndPosition return and parameter types from StringView to owning String: the old optional<StringView> was bound from listItem->markerText() (a temporary String) and returned as a StringView into a destroyed local, a use-after-free read. The commit also restructures the marker-content-update set to hold RenderListItem rather than possibly-destroyed RenderListMarker renderers.
Triage note: Changes lineStartListMarkerText/listMarkerTextForNodeAndPosition return and parameter types from StringView to owning String: the old optional<StringView> was bound from listItem->markerText() (a temporary String) and returned as a StringView into a destroyed local, a use-after-free read. The commit also restructures the marker-content-update set to hold RenderListItem rather than possibly-destroyed RenderListMarker renderers.
Structural signals: smartptr_member_added (+6.47), null_guard (+2.59), area:Source/WebCore/rendering (+2.0), large_churn (-2.0)
Commit message
[list-marker] RenderListItem should answer for its marker instead of its callers consulting RenderListMarker
https://bugs.webkit.org/show_bug.cgi?id=323151
rdar://problem/186407352
Reviewed by Antti Koivisto.
Preparation for making an inside marker an inline content: an anonymous inline box holding the marker's renderers.
There is no RenderListMarker in that setup (only an anon RenderInline), so every question that is asked of the renderer on trunk by reaching for RenderListMarker has to be answerable without one.
No change in behavior.
* Source/WebCore/rendering/RenderListItem.cpp:
(WebCore::RenderListItem::updateMarkerContent):
(WebCore::RenderListItem::updateValueAndMarkerContent):
(WebCore::RenderListItem::markerText const):
(WebCore::RenderListItem::updateListMarkerNumbers):
(WebCore::RenderListItem::paintObject):
* Source/WebCore/rendering/RenderListItem.h:
* Source/WebCore/rendering/RenderListMarker.cpp:
(WebCore::counterStyleFor):
(WebCore::RenderListMarker::counterStyle const):
(WebCore::listMarkerIsDisclosure):
(WebCore::listMarkerSynthesizesGlyph):
(WebCore::listMarkerTextContent):
(WebCore::setListMarkerInlineMargins):
(WebCore::RenderListMarker::updateContent):
(WebCore::RenderListMarker::updateInlineMargins):
(WebCore::RenderListMarker::isDisclosureMarker const):
* Source/WebCore/rendering/RenderListMarker.h:
* Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::addListItemNeedingMarkerUpdate):
(WebCore::RenderTreeBuilder::updateListMarkerContents):
(WebCore::RenderTreeBuilder::attachToRenderElementInternal):
(WebCore::RenderTreeBuilder::detachFromRenderElement):
(WebCore::RenderTreeBuilder::addListMarkerNeedingContentUpdate): Deleted.
* Source/WebCore/rendering/updating/RenderTreeBuilder.h:
* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):
* Source/WebCore/accessibility/AccessibilityObject.cpp:
(WebCore::lineStartListMarkerText):
(WebCore::AccessibilityObject::listMarkerTextForNodeAndPosition):
* Source/WebCore/accessibility/AccessibilityObject.h:
Canonical link: https://commits.webkit.org/320447@main
Before / after
Loading diff…
On This Page