← WebKit — 2026-W39
6576835764ea587208ba38b8ffbbc95389167d93 Fix FontMetrics reference UAF
severity medium
class UAF
confidence 0.65
signal score 6.3
Source/WebCore/html
patch-now
Primitive: Dangling reference to primary-font FontMetrics after width() rebuilds the font cache in canvas measureText
Triage note: RC_REMOVE_SEC_ACCEL_3-bracketed fix moves `auto& fontMetrics = fontProxy->metricsOfPrimaryFont()` to after fontWidth/width() is computed, with the comment that width() can rebuild the font cache; the previously-held reference would dangle and ascent()/descent() read freed/reallocated FontMetrics, reachable from JS CanvasRenderingContext2D.measureText.
Triage note: RC_REMOVE_SEC_ACCEL_3-bracketed fix moves `auto& fontMetrics = fontProxy->metricsOfPrimaryFont()` to after fontWidth/width() is computed, with the comment that width() can rebuild the font cache; the previously-held reference would dangle and ascent()/descent() read freed/reallocated FontMetrics, reachable from JS CanvasRenderingContext2D.measureText.
Structural signals: msg_strong (+3.0), area:Source/WebCore/html (+2.0), surgical (+1.3)
Commit message
Fix FontMetrics reference UAF
rdar://187946124
Reviewed by Vitor Roriz.
CanvasRenderingContext2DBase::measureTextInternal() holds a reference to the
primary font's FontMetrics across a fontProxy->width() call; however width()
can mutate the FontCache, and thus free the FontMetrics object.
Move the metrics retrieval down past text measurement so that it cannot be
invalidated before it is used.
Test: sar3/fast/canvas/offscreen-canvas2d-measuretext-font-metrics-uaf.html
* LayoutTests/sar3/fast/canvas/offscreen-canvas2d-measuretext-font-metrics-uaf-expected.txt: Added.
* LayoutTests/sar3/fast/canvas/offscreen-canvas2d-measuretext-font-metrics-uaf.html: Added.
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::measureTextInternal):
Canonical link: https://commits.webkit.org/316606.795@safari-7625-branch
Before / after
Loading diff…
On This Page