← WebKit — 2026-W35
6743d4ebb647587a2b5b6ae8df4041490b87eb54 cssCanvasClients() returns a set of raw Element pointers
severity medium
class UAF
confidence 0.3
signal score 9.77
Source/WebCore/html
Primitive: returned HashSet<Element*> of raw pointers could dangle before callers use them
Triage note: CanvasBase::cssCanvasClients and InspectorCanvas::cssCanvasClientNodes change return type from HashSet<Element*> to HashSet<Ref<Element>>, holding the elements alive for callers (PageCanvasAgent). Raw-pointer-container to owning-Ref hardening, inspector-adjacent, no identified bug, so not graded exploitable.
Triage note: CanvasBase::cssCanvasClients and InspectorCanvas::cssCanvasClientNodes change return type from HashSet<Element*> to HashSet<Ref<Element>>, holding the elements alive for callers (PageCanvasAgent). Raw-pointer-container to owning-Ref hardening, inspector-adjacent, no identified bug, so not graded exploitable.
Structural signals: smartptr_member_added (+6.47), area:Source/WebCore/html (+2.0), surgical (+1.3)
Commit message
cssCanvasClients() returns a set of raw Element pointers
https://bugs.webkit.org/show_bug.cgi?id=322363
rdar://185651379
Reviewed by Chris Dumez.
CanvasBase::cssCanvasClients() and InspectorCanvas::cssCanvasClientNodes() were
the last HashSet<Element*> in WebCore; every other Element set in the tree is a
HashSet<Ref<Element>> or a WeakHashSet<Element>. Nothing misbehaves today —
the set is built and drained inside a single synchronous inspector call, with no
script or layout in between — but the uncounted container has no reason to exist
here: the producer already holds a RefPtr to each element, and both consumers
immediately re-ref every entry.
Return HashSet<Ref<Element>> instead and let the callers iterate Refs directly.
* Source/WebCore/html/CanvasBase.cpp:
(WebCore::CanvasBase::cssCanvasClients const):
(WebCore:: const): Deleted.
* Source/WebCore/html/CanvasBase.h:
* Source/WebCore/inspector/InspectorCanvas.cpp:
(WebCore::InspectorCanvas::cssCanvasClientNodes const):
* Source/WebCore/inspector/InspectorCanvas.h:
* Source/WebCore/inspector/agents/page/PageCanvasAgent.cpp:
(WebCore::PageCanvasAgent::requestCSSCanvasClientNodes):
Canonical link: https://commits.webkit.org/319679@main
Before / after
Loading diff…
On This Page