← WebKit — 2026-W35
04390f8f4dde2cbb5a70d9d04ed5ffc4bb360f14 REGRESSION(316706@main) tess.oconnor.cx: lots of spacing between image and content towards bottom of page
severity medium
class OOB-write
confidence 0.6
signal score 6.1
Source/WebCore/rendering
patch-now
Primitive: out-of-bounds index into GridBaselineAlignment maxAscents when groupIndex exceeded the vector size
Triage note: Old updateBaselineAlignmentContext only append()ed when groupIndex == maxAscents.size() then wrote context.maxAscents[groupIndex], an OOB access if groupIndex > size; the fix changes the test to >= and uses grow(groupIndex + 1) before indexing, plus an alignmentSubjectCount<2 guard. Grid baseline alignment is reachable from attacker CSS.
Triage note: Old updateBaselineAlignmentContext only append()ed when groupIndex == maxAscents.size() then wrote context.maxAscents[groupIndex], an OOB access if groupIndex > size; the fix changes the test to >= and uses grow(groupIndex + 1) before indexing, plus an alignmentSubjectCount<2 guard. Grid baseline alignment is reachable from attacker CSS.
Structural signals: clamp_saturate (+1.8), msg_soft (+1.0), area:Source/WebCore/rendering (+2.0), surgical (+1.3)
Commit message
REGRESSION(316706@main) tess.oconnor.cx: lots of spacing between image and content towards bottom of page
https://bugs.webkit.org/show_bug.cgi?id=322875
rdar://186102748
Reviewed by Antti Koivisto.
316706@main dropped the BaselineGroup::computeSize() > 1 guard from baselineOffsetForGridItem() on the assumption
that a single participant's max ascent is its own ascent, so that the offset is already zero.
That only holds while the ascent is stable: it is collected in computeBaselineAlignmentContext()
and computed again when the offset is queried. An item whose used size is only resolved after track sizing
(e.g. a replaced item with a percentage max-width) reports a smaller ascent by then, and the stale, larger max ascent turns into
a baseline offset that pushes the single item away from the start of its grid area.
Track the number of alignment subjects next to the max ascent in GridBaselineAlignment's per-context state and restore the guard (similar to what we had before 316706@main).
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-align-baseline-single-item-001-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-align-baseline-single-item-001.html: Added.
* Source/WebCore/rendering/GridBaselineAlignment.cpp:
(WebCore::GridBaselineAlignment::updateBaselineAlignmentContext):
(WebCore::GridBaselineAlignment::baselineOffsetForGridItem const):
* Source/WebCore/rendering/GridBaselineAlignment.h:
Canonical link: https://commits.webkit.org/320115@main
Before / after
Loading diff…
On This Page