← WebKit — 2026-W38
e00bb56e7fce1ff9a0ec50a02702cf887658c679 UAF in HTMLCanvasElement::createContextWebGL when webglcontextcreationerror re-enters getContext
severity medium
class UAF
confidence 0.62
signal score 7.5
Source/WebCore/html
patch-now
Primitive: re-entrant WebGL context creation overwrote an already-assigned m_context, dropping/dangling a live context
Triage note: RC_REMOVE_SEC_ACCEL_3 marks the fix: createContextWebGL builds the context into a local, and because 'due to re-entrancy, m_context may have been assigned in the error case' returns nullptr and ASSERTs !m_context before assigning, preventing the old unconditional m_context overwrite that could release/replace a context created re-entrantly.
Triage note: RC_REMOVE_SEC_ACCEL_3 marks the fix: createContextWebGL builds the context into a local, and because 'due to re-entrancy, m_context may have been assigned in the error case' returns nullptr and ASSERTs !m_context before assigning, preventing the old unconditional m_context overwrite that could release/replace a context created re-entrantly.
Structural signals: null_guard (+1.2), msg_strong (+3.0), area:Source/WebCore/html (+2.0), surgical (+1.3)
Commit message
UAF in HTMLCanvasElement::createContextWebGL when webglcontextcreationerror re-enters getContext
rdar://183926480
Reviewed by Kimmo Kinnunen.
WebGLRenderingContextBase::create() fires webglcontextcreationerror before returning nullptr.
Every check guarding m_context has already run by then, so a listener that
calls getContext('2d') sets m_context to a new CanvasRenderingContext2D.
We only set m_context if it is still null.
Test: fast/canvas/canvas-getContext-reentrant-from-webglcontextcreationerror.html
* Source/WebCore/html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::getContext):
(WebCore::HTMLCanvasElement::createContextWebGL):
* LayoutTests/sar3/fast/canvas/canvas-getContext-reentrant-from-webglcontextcreationerror-expected.txt: Added.
* LayoutTests/sar3/fast/canvas/canvas-getContext-reentrant-from-webglcontextcreationerror.html: Added.
Identifier: 316606.707@safari-7625-branch
Before / after
Loading diff…
On This Page