Commit message: None
CVE: CVE-2016-1643
CWE: CWE-361
Vulnerability description: The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."

Project: Chrome

inline ImageInputType::ImageInputType(HTMLInputElement& element)
    : BaseButtonInputType(element)
    , m_useFallbackContent(false)
{
}

Project: Chrome

void ImageInputType::altAttributeChanged()
{
    if (element().userAgentShadowRoot()) {
        Element* text = element().userAgentShadowRoot()->getElementById("alttext");
        String value = element().altText();
        if (text && text->textContent() != value)
            text->setTextContent(element().altText());
    }
}

Project: Chrome

void ImageInputType::appendToFormData(FormData& formData) const
{
    if (!element().isActivatedSubmit())
        return;
    const AtomicString& name = element().name();
    if (name.isEmpty()) {
        formData.append("x", m_clickLocation.x());
        formData.append("y", m_clickLocation.y());
        return;
    }

    DEFINE_STATIC_LOCAL(String, dotXString, (".x"));
    DEFINE_STATIC_LOCAL(String, dotYString, (".y"));
    formData.append(name + dotXString, m_clickLocation.x());
    formData.append(name + dotYString, m_clickLocation.y());

    if (!element().value().isEmpty())
        formData.append(name, element().value());
}

Project: Chrome

bool ImageInputType::canBeSuccessfulSubmitButton()
{
    return true;
}

Project: Chrome

PassRefPtrWillBeRawPtr<InputType> ImageInputType::create(HTMLInputElement& element)
{
    return adoptRefWillBeNoop(new ImageInputType(element));
}

Project: Chrome

LayoutObject* ImageInputType::createLayoutObject(const ComputedStyle& style) const
{
    if (m_useFallbackContent)
        return new LayoutBlockFlow(&element());
    LayoutImage* image = new LayoutImage(&element());
    image->setImageResource(LayoutImageResource::create());
    return image;
}

Project: Chrome

void ImageInputType::createShadowSubtree()
{
    if (!m_useFallbackContent) {
        BaseButtonInputType::createShadowSubtree();
        return;
    }
    HTMLImageFallbackHelper::createAltTextShadowTree(element());
}

Project: Chrome

PassRefPtr<ComputedStyle> ImageInputType::customStyleForLayoutObject(PassRefPtr<ComputedStyle> newStyle)
{
    if (!m_useFallbackContent)
        return newStyle;

    return HTMLImageFallbackHelper::customStyleForAltText(element(), newStyle);
}

Project: Chrome

void ImageInputType::ensureFallbackContent()
{
    if (m_useFallbackContent)
        return;
    setUseFallbackContent();
    reattachFallbackContent();
}

Project: Chrome

static IntPoint extractClickLocation(Event* event)
{
    if (!event->underlyingEvent() || !event->underlyingEvent()->isMouseEvent())
        return IntPoint();
    MouseEvent* mouseEvent = toMouseEvent(event->underlyingEvent());
    if (!mouseEvent->hasPosition())
        return IntPoint();
    return IntPoint(mouseEvent->offsetX(), mouseEvent->offsetY());
}

Project: Chrome

const AtomicString& ImageInputType::formControlType() const
{
    return InputTypeNames::image;
}

Project: Chrome

void ImageInputType::handleDOMActivateEvent(Event* event)
{
    RefPtrWillBeRawPtr<HTMLInputElement> element(this->element());
    if (element->isDisabledFormControl() || !element->form())
        return;
    element->setActivatedSubmit(true);
    m_clickLocation = extractClickLocation(event);
    element->form()->prepareForSubmission(event); // Event handlers can run.
    element->setActivatedSubmit(false);
    event->setDefaultHandled();
}

Project: Chrome

bool ImageInputType::hasLegalLinkAttribute(const QualifiedName& name) const
{
    return name == srcAttr || BaseButtonInputType::hasLegalLinkAttribute(name);
}

Project: Chrome

bool ImageInputType::isFormDataAppendable() const
{
    return true;
}

Project: Chrome

bool ImageInputType::isImage() const
{
    return true;
}

Project: Chrome

void ImageInputType::reattachFallbackContent()
{
    if (element().document().inStyleRecalc())
        element().reattach();
    else
        element().lazyReattachIfAttached();
}

Project: Chrome

String ImageInputType::resultForDialogSubmit() const
{
    StringBuilder result;
    result.appendNumber(m_clickLocation.x());
    result.append(',');
    result.appendNumber(m_clickLocation.y());
    return result.toString();
}

Project: Chrome

void ImageInputType::setUseFallbackContent()
{
    if (m_useFallbackContent)
        return;
    m_useFallbackContent = true;
    if (element().document().inStyleRecalc())
        return;
    if (ShadowRoot* root = element().userAgentShadowRoot())
        root->removeChildren();
    createShadowSubtree();
}

Project: Chrome

bool ImageInputType::shouldRespectAlignAttribute()
{
    return true;
}

Project: Chrome

bool ImageInputType::shouldRespectHeightAndWidthAttributes()
{
    return true;
}

Project: Chrome

void ImageInputType::srcAttributeChanged()
{
    if (!element().layoutObject())
        return;
    element().ensureImageLoader().updateFromElement(ImageLoader::UpdateIgnorePreviousError);
}

Project: Chrome

void ImageInputType::startResourceLoading()
{
    BaseButtonInputType::startResourceLoading();

    HTMLImageLoader& imageLoader = element().ensureImageLoader();
    imageLoader.updateFromElement();

    LayoutObject* layoutObject = element().layoutObject();
    if (!layoutObject || !layoutObject->isLayoutImage())
        return;

    LayoutImageResource* imageResource = toLayoutImage(layoutObject)->imageResource();
    imageResource->setImageResource(imageLoader.image());
}

Project: Chrome

bool ImageInputType::supportsValidation() const
{
    return false;
}

Project: Chrome

void ImageInputType::valueAttributeChanged()
{
    if (m_useFallbackContent)
        return;
    BaseButtonInputType::valueAttributeChanged();
}

Project: Chrome

unsigned ImageInputType::width() const
{
    RefPtrWillBeRawPtr<HTMLInputElement> element(this->element());

    if (!element->layoutObject()) {
        unsigned width;
        if (parseHTMLNonNegativeInteger(element->fastGetAttribute(widthAttr), width))
            return width;

        HTMLImageLoader* imageLoader = element->imageLoader();
        if (imageLoader && imageLoader->image())
            return imageLoader->image()->imageSize(LayoutObject::shouldRespectImageOrientation(nullptr), 1).width();
    }

    element->document().updateLayout();

    LayoutBox* box = element->layoutBox();
    return box ? adjustForAbsoluteZoom(box->contentWidth(), box) : 0;
}