CVE-2024-23222
Overview
Advisory: Apple Security Advisory
Impact:
Description: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited.
| Attribute | Value |
|---|---|
| CVE | CVE-2024-23222 |
| Bugzilla | 267134 |
| Component | WebCore |
| Bug Class | TypeConfusion |
| Severity | critical |
| Commit | a973b2b5b5cbd087… |
| Advisory | Apple Advisory |
Root Cause Analysis
A type confusion issue was addressed with improved checks.
Files Changed
Source Files
Source/WebCore/ChangeLogSource/WebCore/layout/layouttree/LayoutBox.cpp
Patch Preview
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 399d9430452c..3a1a74aa194a 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2020-09-15 Zalan Bujtas <[email protected]>
+
+ [LFC][FFC] 'display: flex' generates a flex container box that is block-level when placed in flow layout
+ https://bugs.webkit.org/show_bug.cgi?id=216596
+
+ Reviewed by Simon Fraser.
+
+ See https://www.w3.org/TR/css-flexbox-1/#flex-containers.
+
+ * layout/layouttree/LayoutBox.cpp:
+ (WebCore::Layout::Box::isBlockLevelBox const):
+
2020-09-15 Zalan Bujtas <[email protected]>
[LFC] Use isBlockBox() in Box::establishesBlockFormattingContext
diff --git a/Source/WebCore/layout/layouttree/LayoutBox.cpp b/Source/WebCore/layout/layouttree/LayoutBox.cpp
index ae3b1a4e1369..6f2f203834cf 100644
--- a/Source/WebCore/layout/layouttree/LayoutBox.cpp
+++ b/Source/WebCore/layout/layouttree/LayoutBox.cpp
@@ -295,7 +295,7 @@ bool Box::isBlockLevelBox() const
{
// Block level elements generate block level boxes.
auto display = m_style.display();
- return display == DisplayType::Block || display == DisplayType::ListItem || display == DisplayType::Table;
+ return display == DisplayType::Block || display == DisplayType::ListItem || display == DisplayType::Table || display == DisplayType::Flex;
}
bool Box::isBlockBox() const