Chrome · Layout › Layout
CVE-2026-118344
UAF in Layout (Layout)
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
has_shape_exclusionsthird_party/blink/renderer/core/layout/exclusions/exclusion_space.h |
modified |
Files Changed
third_party/blink/renderer/core/layout/exclusions/exclusion_space.hthird_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
Patch
From 5173a94262b618f50810938fa3d50b8a36a68886 Mon Sep 17 00:00:00 2001 From: Ian Kilpatrick <[email protected]> Date: Thu, 22 Oct 2026 15:29:38 -0700 Subject: [PATCH] [layout] Add move constructor and assignment operator to Shelf. This adds the missing move constructor & assignment operator to the Shelf data-type. Additionally adds the copy assignment operator for completeness. Fixed: 574852698 Change-Id: Ief97ee317f7aba8d86b3c6cf920cb362efc679c5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8633358 Reviewed-by: David Grogan <[email protected]> Commit-Queue: Ian Kilpatrick <[email protected]> Cr-Commit-Position: refs/heads/main@{#1725253} --- diff --git a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc index e2f5e2b5..e17476b3 100644 --- a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc +++ b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc @@ -615,7 +615,7 @@ ? LayoutUnit::Max() : shelf_copy->line_right; - shelves_.insert(i + 1, new_shelf); + shelves_.insert(i + 1, std::move(new_shelf)); } // It's safe to early exit out of this loop now. This exclusion won't diff --git a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h index 2260e12..f61f28058 100644 --- a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h +++ b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h @@ -322,7 +322,8 @@ : nullptr), has_shape_exclusions(false) {} - // The copy constructor explicitly copies the shape_exclusions member. + // The copy constructor and copy assignment operator explicitly copy the + // shape_exclusions member. Shelf(const Shelf& other) : block_offset(other.block_offset), line_left(other.line_left), @@ -334,6 +335,22 @@ *other.shape_exclusions) : nullptr), has_shape_exclusions(other.has_shape_exclusions) {} + Shelf(Shelf&&) noexcept = default; + + Shelf& operator=(const Shelf& other) { + block_offset = other.block_offset; + line_left = other.line_left; + line_right = other.line_right; + line_left_edges = other.line_left_edges; + line_right_edges = other.line_right_edges; + shape_exclusions = + other.shape_exclusions + ? MakeGarbageCollected<ShapeExclusions>(*other.shape_exclusions) + : nullptr; + has_shape_exclusions = other.has_shape_exclusions; + return *this; + } + Shelf& operator=(Shelf&&) noexcept = default; void Trace(Visitor* visitor) const { visitor->Trace(shape_exclusions); }
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page