<?xml version="1.0" encoding="UTF-8"?>
<report tool_name="marfcat" tool_version="SATE2010.4">
	<weakness id="1" tool_specific_id="1">
		<name cweid="20">Input Validation (CWE-20)</name>
		<location id="3345" line="178" path="chrome-5.0.375.54/chrome/browser/renderer_host/database_dispatcher_host.cc">
			<fragment>
173:       if (!db_file.empty()) {
174:         VfsBackend::OpenFile(db_file, desired_flags, process_handle_,
175:                              &amp;target_handle, &amp;target_dir_handle);
176:       }
177:   }
178: 
179:   ViewHostMsg_DatabaseOpenFile::WriteReplyParams(
180:       reply_msg,
181: #if defined(OS_WIN)
182:       target_handle
183: #elif defined(OS_POSIX)

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/375/src/chrome/browser/renderer_host/database_dispatcher_host.cc	2010/05/24 18:11:39	48056
+++ branches/375/src/chrome/browser/renderer_host/database_dispatcher_host.cc	2010/05/24 18:16:26	48057
@@ -176,6 +176,12 @@
       }
   }
           
+#if defined(OS_POSIX)
+  if (target_dir_handle &gt;= 0)
+    close(target_dir_handle);
+  target_dir_handle = -1;
+#endif
+
   ViewHostMsg_DatabaseOpenFile::WriteReplyParams(
       reply_msg,
 #if defined(OS_WIN)

SATE: browser/renderer_host/database_dispatcher_host.cc in Google Chrome before 5.0.375.70
on Linux does not properly handle ViewHostMsg_DatabaseOpenFile messages in chroot-based sandboxing,
which allows remote attackers to bypass intended sandbox restrictions via vectors involving
fchdir and chdir calls.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/chrome/browser/renderer_host/database_dispatcher_host.cc
              Path ID: 3345
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:5ms:5ms
         Subject's ID: 24
   Subject identified: CVE-2010-2298
Resultset: Raw ResultSet data:
[[24:0.0:ID=24, outcome=0.0], [23:623.7889647856293:ID=23, outcome=623.7889647856293], [21:631.988316832082:ID=21, outcome=631.988316832082], [18:561.8874460141375:ID=18, outcome=561.8874460141375], [25:807.093797526445:ID=25, outcome=807.093797526445], [19:738.3398656405908:ID=19, outcome=738.3398656405908], [27:754.2957497531079:ID=27, outcome=754.2957497531079], [22:752.8651146714533:ID=22, outcome=752.8651146714533], [20:752.8651146714533:ID=20, outcome=752.8651146714533]]

Sorted data:
([24:0.0:ID=24, outcome=0.0],[18:561.8874460141375:ID=18, outcome=561.8874460141375],[23:623.7889647856293:ID=23, outcome=623.7889647856293],[21:631.988316832082:ID=21, outcome=631.988316832082],[19:738.3398656405908:ID=19, outcome=738.3398656405908],[22:752.8651146714533:ID=22, outcome=752.8651146714533],[20:752.8651146714533:ID=20, outcome=752.8651146714533],[27:754.2957497531079:ID=27, outcome=754.2957497531079],[25:807.093797526445:ID=25, outcome=807.093797526445])
Expected subject's ID: 24 (possible: [24])
     Expected subject: CVE-2010-2298
       Second Best ID: 18
     Second Best Name: CVE-2010-2304
            Date/time: Tue Sep 07 05:01:08 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="2" tool_specific_id="2">
		<name cweid="94">Code Injection (CWE-94)</name>
		<location id="3347" line="877" path="chrome-5.0.375.54/chrome/browser/renderer_host/resource_message_filter.cc">
			<fragment>
872: 
873:   ChromeThread::PostTask(
874:       ChromeThread::UI,
875:       FROM_HERE,
876:       new WriteClipboardTask(long_living_objects));
877: }
878: 
879: #if !defined(USE_X11)
880: // On non-X11 platforms, clipboard actions can be performed on the IO thread.
881: // On X11, since the clipboard is linked with GTK, we either have to do this
882: // with GTK on the UI thread, or with Xlib on the BACKGROUND_X11 thread. In an

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- trunk/src/chrome/browser/renderer_host/resource_message_filter.cc	2010/05/06 22:51:04	46638
+++ trunk/src/chrome/browser/renderer_host/resource_message_filter.cc	2010/05/06 23:11:30	46639
@@ -875,6 +875,10 @@
   // the write on the UI thread.
   Clipboard::ObjectMap* long_living_objects = new Clipboard::ObjectMap(objects);
       
+  // This async message doesn't support shared-memory based bitmaps; they must
+  // be removed otherwise we might dereference a rubbish pointer.
+  long_living_objects-&gt;erase(Clipboard::CBF_SMBITMAP);
+
   ChromeThread::PostTask(
       ChromeThread::UI,
       FROM_HERE,

SATE: The Clipboard::DispatchObject function in app/clipboard/clipboard.cc in Google
Chrome before 5.0.375.70 does not properly handle CBF_SMBITMAP objects in a
ViewHostMsg_ClipboardWriteObjectsAsync message, which might allow remote attackers
to execute arbitrary code via vectors involving crafted data from the renderer process,
related to a "Type Confusion" issue.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/chrome/browser/renderer_host/resource_message_filter.cc
              Path ID: 3347
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:11ms:11ms
         Subject's ID: 23
   Subject identified: CVE-2010-2299
Resultset: Raw ResultSet data:
[[24:623.7889647856293:ID=24, outcome=623.7889647856293], [23:0.0:ID=23, outcome=0.0], [21:388.34617214318104:ID=21, outcome=388.34617214318104], [18:511.9031712580475:ID=18, outcome=511.9031712580475], [25:638.5363285573005:ID=25, outcome=638.5363285573005], [19:487.491169452452:ID=19, outcome=487.491169452452], [27:404.5064179127561:ID=27, outcome=404.5064179127561], [22:413.7038827192207:ID=22, outcome=413.7038827192207], [20:413.7038827192207:ID=20, outcome=413.7038827192207]]

Sorted data:
([23:0.0:ID=23, outcome=0.0],[21:388.34617214318104:ID=21, outcome=388.34617214318104],[27:404.5064179127561:ID=27, outcome=404.5064179127561],[22:413.7038827192207:ID=22, outcome=413.7038827192207],[20:413.7038827192207:ID=20, outcome=413.7038827192207],[19:487.491169452452:ID=19, outcome=487.491169452452],[18:511.9031712580475:ID=18, outcome=511.9031712580475],[24:623.7889647856293:ID=24, outcome=623.7889647856293],[25:638.5363285573005:ID=25, outcome=638.5363285573005])
Expected subject's ID: 23 (possible: [23])
     Expected subject: CVE-2010-2299
       Second Best ID: 21
     Second Best Name: CVE-2010-2301
            Date/time: Tue Sep 07 05:01:08 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="3" tool_specific_id="3">
		<name cweid="79">Cross-Site Scripting (XSS) (CWE-79)</name>
		<location id="26096" line="407" path="chrome-5.0.375.54/third_party/WebKit/WebCore/editing/markup.cpp">
			<fragment>
402:     switch (node-&gt;nodeType()) {
403:         case Node::TEXT_NODE: {
404:             if (Node* parent = node-&gt;parentNode()) {
405:                 if (parent-&gt;hasTagName(scriptTag)
406:                     || parent-&gt;hasTagName(styleTag)
407:                     || parent-&gt;hasTagName(textareaTag)
408:                     || parent-&gt;hasTagName(xmpTag)) {
409:                     appendUCharRange(result, ucharRange(node, range));
410:                     break;
411:                 }
412:             }

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/editing/markup.cpp	2010/05/24 18:32:49	48061
+++ branches/WebKit/375/WebCore/editing/markup.cpp	2010/05/24 18:54:42	48062
@@ -404,10 +404,12 @@
             if (Node* parent = node-&gt;parentNode()) {
                 if (parent-&gt;hasTagName(scriptTag)
                     || parent-&gt;hasTagName(styleTag)
-                    || parent-&gt;hasTagName(textareaTag)
                     || parent-&gt;hasTagName(xmpTag)) {
                     appendUCharRange(result, ucharRange(node, range));
                     break;
+                } else if (parent-&gt;hasTagName(textareaTag)) {
+                    appendEscapedContent(result, ucharRange(node, range), documentIsHTML);                    
+                    break;
                 }
             }
             if (!annotate) {

SATE: An error related to the "innerHTML" property of textarea can be exploited
to conduct cross-site scripting attacks.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/editing/markup.cpp
              Path ID: 26096
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:10ms:10ms
         Subject's ID: 21
   Subject identified: CVE-2010-2301
Resultset: Raw ResultSet data:
[[24:631.988316832082:ID=24, outcome=631.988316832082], [23:388.34617214318104:ID=23, outcome=388.34617214318104], [21:0.0:ID=21, outcome=0.0], [18:510.43887714394464:ID=18, outcome=510.43887714394464], [25:628.257263452319:ID=25, outcome=628.257263452319], [19:489.0477156358686:ID=19, outcome=489.0477156358686], [27:411.3848856286059:ID=27, outcome=411.3848856286059], [22:384.82296045616033:ID=22, outcome=384.82296045616033], [20:384.82296045616033:ID=20, outcome=384.82296045616033]]

Sorted data:
([21:0.0:ID=21, outcome=0.0],[22:384.82296045616033:ID=22, outcome=384.82296045616033],[20:384.82296045616033:ID=20, outcome=384.82296045616033],[23:388.34617214318104:ID=23, outcome=388.34617214318104],[27:411.3848856286059:ID=27, outcome=411.3848856286059],[19:489.0477156358686:ID=19, outcome=489.0477156358686],[18:510.43887714394464:ID=18, outcome=510.43887714394464],[25:628.257263452319:ID=25, outcome=628.257263452319],[24:631.988316832082:ID=24, outcome=631.988316832082])
Expected subject's ID: 21 (possible: [21])
     Expected subject: CVE-2010-2301
       Second Best ID: 22
     Second Best Name: CVE-2010-2300
            Date/time: Tue Sep 07 05:02:39 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="4" tool_specific_id="4">
		<name cweid="119">Buffer Errors (CWE-119)</name>
		<location id="28947" line="104" path="chrome-5.0.375.54/third_party/WebKit/WebCore/rendering/RenderListMarker.cpp">
			<fragment>
99:     }
100:     letters[lettersSize - 1] = sequence[numberShadow % sequenceSize];
101:     int length = 1;
102: 
103:     if (type == AlphabeticSequence) {
104:         while ((numberShadow /= sequenceSize) &gt; 0)
105:             letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize - 1];
106:     } else {
107:         while ((numberShadow /= sequenceSize) &gt; 0)
108:             letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];
109:     }

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/rendering/RenderListMarker.cpp	2010/05/24 23:24:17	48099
+++ branches/WebKit/375/WebCore/rendering/RenderListMarker.cpp	2010/05/24 23:26:18	48100
@@ -101,8 +101,10 @@
     int length = 1;
      
     if (type == AlphabeticSequence) {
-        while ((numberShadow /= sequenceSize) &gt; 0)
-            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize - 1];
+        while ((numberShadow /= sequenceSize) &gt; 0) {
+            --numberShadow;
+            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];
+        }
     } else {
             while ((numberShadow /= sequenceSize) &gt; 0)
                 letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];

SATE: The toAlphabetic function has a bug that allows remote attackers to cause
memory corruption or possibly execute arbitrary code.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/rendering/RenderListMarker.cpp
              Path ID: 28947
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:10ms:10ms
         Subject's ID: 18
   Subject identified: CVE-2010-2304
Resultset: Raw ResultSet data:
[[24:561.8874460141375:ID=24, outcome=561.8874460141375], [23:511.9031712580475:ID=23, outcome=511.9031712580475], [21:510.43887714394464:ID=21, outcome=510.43887714394464], [18:0.0:ID=18, outcome=0.0], [25:677.8886200772087:ID=25, outcome=677.8886200772087], [19:585.4542097850024:ID=19, outcome=585.4542097850024], [27:548.174957502129:ID=27, outcome=548.174957502129], [22:575.3837488752738:ID=22, outcome=575.3837488752738], [20:575.3837488752738:ID=20, outcome=575.3837488752738]]

Sorted data:
([18:0.0:ID=18, outcome=0.0],[21:510.43887714394464:ID=21, outcome=510.43887714394464],[23:511.9031712580475:ID=23, outcome=511.9031712580475],[27:548.174957502129:ID=27, outcome=548.174957502129],[24:561.8874460141375:ID=24, outcome=561.8874460141375],[22:575.3837488752738:ID=22, outcome=575.3837488752738],[20:575.3837488752738:ID=20, outcome=575.3837488752738],[19:585.4542097850024:ID=19, outcome=585.4542097850024],[25:677.8886200772087:ID=25, outcome=677.8886200772087])
Expected subject's ID: 18 (possible: [18])
     Expected subject: CVE-2010-2304
       Second Best ID: 21
     Second Best Name: CVE-2010-2301
            Date/time: Tue Sep 07 05:02:50 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="5" tool_specific_id="5">
		<name cweid="94">Code Injection (CWE-94)</name>
		<location id="29096" line="169" path="chrome-5.0.375.54/third_party/WebKit/WebCore/rendering/FixedTableLayout.cpp">
			<fragment>
164:                 if (w.isFixed() &amp;&amp; w.isPositive())
165:                     effWidth = w.value();
166:                 
167:                 int usedSpan = 0;
168:                 int i = 0;
169:                 while (usedSpan &lt; span) {
170:                     ASSERT(cCol + i &lt; nEffCols);
171:                     int eSpan = m_table-&gt;spanOfEffCol(cCol + i);
172:                     // Only set if no col element has already set it.
173:                     if (m_width[cCol + i].isAuto() &amp;&amp; w.type() != Auto) {
174:                         m_width[cCol + i].setRawValue(w.type(), w.rawValue() * eSpan / span);

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/rendering/FixedTableLayout.cpp	2010/05/24 18:22:34	48058
+++ branches/WebKit/375/WebCore/rendering/FixedTableLayout.cpp	2010/05/24 18:26:34	48059
@@ -166,8 +166,7 @@
                 
                 int usedSpan = 0;
                 int i = 0;
-                while (usedSpan &lt; span) {
-                    ASSERT(cCol + i &lt; nEffCols);
+                while (usedSpan &lt; span &amp;&amp; cCol + i &lt; nEffCols) {
                     int eSpan = m_table-&gt;spanOfEffCol(cCol + i);
                     // Only set if no col element has already set it.
                     if (m_width[cCol + i].isAuto() &amp;&amp; w.type() != Auto) {

SATE: rendering/FixedTableLayout.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70
allows remote attackers to cause a denial of service (application crash) or possibly execute
arbitrary code via an HTML document that has a large colspan attribute within a table.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/rendering/FixedTableLayout.cpp
              Path ID: 29096
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:4ms:4ms
         Subject's ID: 25
   Subject identified: CVE-2010-2297
Resultset: Raw ResultSet data:
[[24:807.093797526445:ID=24, outcome=807.093797526445], [23:638.5363285573005:ID=23, outcome=638.5363285573005], [21:628.257263452319:ID=21, outcome=628.257263452319], [18:677.8886200772087:ID=18, outcome=677.8886200772087], [25:0.0:ID=25, outcome=0.0], [19:639.998080764392:ID=19, outcome=639.998080764392], [27:620.3567343646375:ID=27, outcome=620.3567343646375], [22:599.7570127683828:ID=22, outcome=599.7570127683828], [20:599.7570127683828:ID=20, outcome=599.7570127683828]]

Sorted data:
([25:0.0:ID=25, outcome=0.0],[22:599.7570127683828:ID=22, outcome=599.7570127683828],[20:599.7570127683828:ID=20, outcome=599.7570127683828],[27:620.3567343646375:ID=27, outcome=620.3567343646375],[21:628.257263452319:ID=21, outcome=628.257263452319],[23:638.5363285573005:ID=23, outcome=638.5363285573005],[19:639.998080764392:ID=19, outcome=639.998080764392],[18:677.8886200772087:ID=18, outcome=677.8886200772087],[24:807.093797526445:ID=24, outcome=807.093797526445])
Expected subject's ID: 25 (possible: [25])
     Expected subject: CVE-2010-2297
       Second Best ID: 22
     Second Best Name: CVE-2010-2300
            Date/time: Tue Sep 07 05:02:50 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="6" tool_specific_id="6">
		<name cweid="999">Insufficient Information (NVD-CWE-noinfo)</name>
		<location id="29406" line="225" path="chrome-5.0.375.54/third_party/WebKit/WebCore/page/Geolocation.cpp">
			<fragment>
220: 
221: void Geolocation::disconnectFrame()
222: {
223:     if (m_frame &amp;&amp; m_frame-&gt;page() &amp;&amp; m_allowGeolocation == InProgress)
224:         m_frame-&gt;page()-&gt;chrome()-&gt;cancelGeolocationPermissionRequestForFrame(m_frame, this);
225:     stopUpdating();
226:     if (m_frame &amp;&amp; m_frame-&gt;document())
227:         m_frame-&gt;document()-&gt;setUsingGeolocation(false);
228:     m_frame = 0;
229: }
230: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:21:40	48113
+++ branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:29:30	48114
@@ -222,6 +222,7 @@
 {
   if (m_frame &amp;&amp; m_frame-&gt;page() &amp;&amp; m_allowGeolocation == InProgress)
       m_frame-&gt;page()-&gt;chrome()-&gt;cancelGeolocationPermissionRequestForFrame(m_frame, this);
+    stopTimers();
     stopUpdating();
     if (m_frame &amp;&amp; m_frame-&gt;document())
         m_frame-&gt;document()-&gt;setUsingGeolocation(false);

SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================

			</explanation>
		</location>
		<location id="29406" line="100" path="chrome-5.0.375.54/third_party/WebKit/WebCore/page/Geolocation.cpp">
			<fragment>
95: void Geolocation::GeoNotifier::setFatalError(PassRefPtr&lt;PositionError&gt; error)
96: {
97:     // This method is called at most once on a given GeoNotifier object.
98:     ASSERT(!m_fatalError);
99:     m_fatalError = error;
100:     m_timer.startOneShot(0);
101: }
102: 
103: void Geolocation::GeoNotifier::setUseCachedPosition()
104: {
105:     m_useCachedPosition = true;

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:21:40	48113
+++ branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:29:30	48114
@@ -222,6 +222,7 @@
 {
   if (m_frame &amp;&amp; m_frame-&gt;page() &amp;&amp; m_allowGeolocation == InProgress)
       m_frame-&gt;page()-&gt;chrome()-&gt;cancelGeolocationPermissionRequestForFrame(m_frame, this);
+    stopTimers();
     stopUpdating();
     if (m_frame &amp;&amp; m_frame-&gt;document())
         m_frame-&gt;document()-&gt;setUsingGeolocation(false);

SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================
Possible explanation material:
=====================================
SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================

			</explanation>
		</location>
		<location id="29406" line="106" path="chrome-5.0.375.54/third_party/WebKit/WebCore/page/Geolocation.cpp">
			<fragment>
101: }
102: 
103: void Geolocation::GeoNotifier::setUseCachedPosition()
104: {
105:     m_useCachedPosition = true;
106:     m_timer.startOneShot(0);
107: }
108: 
109: bool Geolocation::GeoNotifier::hasZeroTimeout() const
110: {
111:     return m_options-&gt;hasTimeout() &amp;&amp; m_options-&gt;timeout() == 0;

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:21:40	48113
+++ branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:29:30	48114
@@ -222,6 +222,7 @@
 {
   if (m_frame &amp;&amp; m_frame-&gt;page() &amp;&amp; m_allowGeolocation == InProgress)
       m_frame-&gt;page()-&gt;chrome()-&gt;cancelGeolocationPermissionRequestForFrame(m_frame, this);
+    stopTimers();
     stopUpdating();
     if (m_frame &amp;&amp; m_frame-&gt;document())
         m_frame-&gt;document()-&gt;setUsingGeolocation(false);

SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================
Possible explanation material:
=====================================
SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================
Possible explanation material:
=====================================
SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================

			</explanation>
		</location>
		<location id="29406" line="122" path="chrome-5.0.375.54/third_party/WebKit/WebCore/page/Geolocation.cpp">
			<fragment>
117: }
118: 
119: void Geolocation::GeoNotifier::startTimerIfNeeded()
120: {
121:     if (m_options-&gt;hasTimeout())
122:         m_timer.startOneShot(m_options-&gt;timeout() / 1000.0);
123: }
124: 
125: void Geolocation::GeoNotifier::timerFired(Timer&lt;GeoNotifier&gt;*)
126: {
127:     m_timer.stop();

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:21:40	48113
+++ branches/WebKit/375/WebCore/page/Geolocation.cpp	2010/05/25 01:29:30	48114
@@ -222,6 +222,7 @@
 {
   if (m_frame &amp;&amp; m_frame-&gt;page() &amp;&amp; m_allowGeolocation == InProgress)
       m_frame-&gt;page()-&gt;chrome()-&gt;cancelGeolocationPermissionRequestForFrame(m_frame, this);
+    stopTimers();
     stopUpdating();
     if (m_frame &amp;&amp; m_frame-&gt;document())
         m_frame-&gt;document()-&gt;setUsingGeolocation(false);

SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================
Possible explanation material:
=====================================
SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================
Possible explanation material:
=====================================
SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================
Possible explanation material:
=====================================
SATE: Geolocation timers do not stop upon deletion of a document,
allowing remote attack vectors and other unspecified impacts.
=====================================

			</explanation>
		</location>
		<grade
			severity="5"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/page/Geolocation.cpp
              Path ID: 29406
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:5ms:5ms
         Subject's ID: 19
   Subject identified: CVE-2010-2303
Resultset: Raw ResultSet data:
[[24:738.3398656405908:ID=24, outcome=738.3398656405908], [23:487.491169452452:ID=23, outcome=487.491169452452], [21:489.0477156358686:ID=21, outcome=489.0477156358686], [18:585.4542097850024:ID=18, outcome=585.4542097850024], [25:639.998080764392:ID=25, outcome=639.998080764392], [19:0.0:ID=19, outcome=0.0], [27:504.77644820578524:ID=27, outcome=504.77644820578524], [22:484.79320994353134:ID=22, outcome=484.79320994353134], [20:484.79320994353134:ID=20, outcome=484.79320994353134]]

Sorted data:
([19:0.0:ID=19, outcome=0.0],[22:484.79320994353134:ID=22, outcome=484.79320994353134],[20:484.79320994353134:ID=20, outcome=484.79320994353134],[23:487.491169452452:ID=23, outcome=487.491169452452],[21:489.0477156358686:ID=21, outcome=489.0477156358686],[27:504.77644820578524:ID=27, outcome=504.77644820578524],[18:585.4542097850024:ID=18, outcome=585.4542097850024],[25:639.998080764392:ID=25, outcome=639.998080764392],[24:738.3398656405908:ID=24, outcome=738.3398656405908])
Expected subject's ID: 19 (possible: [19])
     Expected subject: CVE-2010-2303
       Second Best ID: 22
     Second Best Name: CVE-2010-2300
            Date/time: Tue Sep 07 05:02:52 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="7" tool_specific_id="7">
		<name cweid="998">Other (NVD-CWE-Other)</name>
		<location id="29498" line="2165" path="chrome-5.0.375.54/third_party/WebKit/WebCore/page/EventHandler.cpp">
			<fragment>
2160:         keydown-&gt;setDefaultPrevented(true);
2161:     keydown-&gt;setTarget(node);
2162: 
2163:     if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
2164:         node-&gt;dispatchEvent(keydown, ec);
2165:         return keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented();
2166:     }
2167: 
2168:     // Run input method in advance of DOM event handling.  This may result in the IM
2169:     // modifying the page prior the keydown event, but this behaviour is necessary
2170:     // in order to match IE:

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/page/EventHandler.cpp	2010/05/24 19:30:45	48066
+++ branches/WebKit/375/WebCore/page/EventHandler.cpp	2010/05/24 19:33:39	48067
@@ -2162,7 +2162,9 @@
 
     if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
         node-&gt;dispatchEvent(keydown, ec);
-        return keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented();
+        // If frame changed as a result of keydown dispatch, then return true to avoid sending a subsequent keypress message to the new frame.
+        bool changedFocusedFrame = m_frame-&gt;page() &amp;&amp; m_frame != m_frame-&gt;page()-&gt;focusController()-&gt;focusedOrMainFrame();
+        return keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented() || changedFocusedFrame;
     }
                    
     // Run input method in advance of DOM event handling.  This may result in the IM

SATE: page/EventHandler.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 does not
properly handle a change of the focused frame during the dispatching of keydown, which allows
user-assisted remote attackers to redirect keystrokes via a crafted HTML document, aka rdar problem
7018610. NOTE: this might overlap CVE-2010-1422.
=====================================

			</explanation>
		</location>
		<location id="29498" line="2187" path="chrome-5.0.375.54/third_party/WebKit/WebCore/page/EventHandler.cpp">
			<fragment>
2182:     }
2183: 
2184:     node-&gt;dispatchEvent(keydown, ec);
2185:     bool keydownResult = keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented();
2186:     if (handledByInputMethod || (keydownResult &amp;&amp; !backwardCompatibilityMode))
2187:         return keydownResult;
2188:     
2189:     // Focus may have changed during keydown handling, so refetch node.
2190:     // But if we are dispatching a fake backward compatibility keypress, then we pretend that the keypress happened on the original node.
2191:     if (!keydownResult) {
2192:         node = eventTargetNodeForDocument(m_frame-&gt;document());

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/page/EventHandler.cpp	2010/05/24 19:30:45	48066
+++ branches/WebKit/375/WebCore/page/EventHandler.cpp	2010/05/24 19:33:39	48067
@@ -2162,7 +2162,9 @@
 
     if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
         node-&gt;dispatchEvent(keydown, ec);
-        return keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented();
+        // If frame changed as a result of keydown dispatch, then return true to avoid sending a subsequent keypress message to the new frame.
+        bool changedFocusedFrame = m_frame-&gt;page() &amp;&amp; m_frame != m_frame-&gt;page()-&gt;focusController()-&gt;focusedOrMainFrame();
+        return keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented() || changedFocusedFrame;
     }
                    
     // Run input method in advance of DOM event handling.  This may result in the IM

SATE: page/EventHandler.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 does not
properly handle a change of the focused frame during the dispatching of keydown, which allows
user-assisted remote attackers to redirect keystrokes via a crafted HTML document, aka rdar problem
7018610. NOTE: this might overlap CVE-2010-1422.
=====================================
Possible explanation material:
=====================================
@@ -2182,7 +2184,9 @@
     }
      
     node-&gt;dispatchEvent(keydown, ec);
-    bool keydownResult = keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented();
+    // If frame changed as a result of keydown dispatch, then return early to avoid sending a subsequent keypress message to the new frame.
+    bool changedFocusedFrame = m_frame-&gt;page() &amp;&amp; m_frame != m_frame-&gt;page()-&gt;focusController()-&gt;focusedOrMainFrame();
+    bool keydownResult = keydown-&gt;defaultHandled() || keydown-&gt;defaultPrevented() || changedFocusedFrame;
     if (handledByInputMethod || (keydownResult &amp;&amp; !backwardCompatibilityMode))
         return keydownResult;

SATE: page/EventHandler.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 does not
properly handle a change of the focused frame during the dispatching of keydown, which allows
user-assisted remote attackers to redirect keystrokes via a crafted HTML document, aka rdar problem
7018610. NOTE: this might overlap CVE-2010-1422.
=====================================

			</explanation>
		</location>
		<grade
			severity="5"
			probability="0.003567175629729723"
			tool_specific_rank="280.33382815966587"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/page/EventHandler.cpp
              Path ID: 29498
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:18ms:18ms
         Subject's ID: 27
   Subject identified: CVE-2010-2295
Resultset: Raw ResultSet data:
[[24:679.4354853014989:ID=24, outcome=679.4354853014989], [23:370.02488889609947:ID=23, outcome=370.02488889609947], [21:322.2636157520464:ID=21, outcome=322.2636157520464], [18:471.7689219847454:ID=18, outcome=471.7689219847454], [25:583.4666018257162:ID=25, outcome=583.4666018257162], [19:432.1455561712887:ID=19, outcome=432.1455561712887], [27:280.33382815966587:ID=27, outcome=280.33382815966587], [22:330.1797700209744:ID=22, outcome=330.1797700209744], [20:330.1797700209744:ID=20, outcome=330.1797700209744]]

Sorted data:
([27:280.33382815966587:ID=27, outcome=280.33382815966587],[21:322.2636157520464:ID=21, outcome=322.2636157520464],[22:330.1797700209744:ID=22, outcome=330.1797700209744],[20:330.1797700209744:ID=20, outcome=330.1797700209744],[23:370.02488889609947:ID=23, outcome=370.02488889609947],[19:432.1455561712887:ID=19, outcome=432.1455561712887],[18:471.7689219847454:ID=18, outcome=471.7689219847454],[25:583.4666018257162:ID=25, outcome=583.4666018257162],[24:679.4354853014989:ID=24, outcome=679.4354853014989])
Expected subject's ID: 27 (possible: [27])
     Expected subject: CVE-2010-2295
       Second Best ID: 21
     Second Best Name: CVE-2010-2301
            Date/time: Tue Sep 07 05:02:52 EDT 2010
Outcome o (classifier-specific): 280.33382815966587
             Distance threshold: 0.1
           Computed raw P = 1/o: 0.003567175629729723
         Warning to be reported: true
          Computed normalized P: 0.003567175629729723

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="8" tool_specific_id="8">
		<name cweid="399">Resource Management Errors (CWE-399)</name>
		<location id="29722" line="1424" path="chrome-5.0.375.54/third_party/WebKit/WebCore/dom/Element.cpp">
			<fragment>
1419: {
1420:     // Normalize attributes.
1421:     NamedNodeMap* attrs = attributes(true);
1422:     if (!attrs)
1423:         return;
1424:     unsigned numAttrs = attrs-&gt;length();
1425:     for (unsigned i = 0; i &lt; numAttrs; i++) {
1426:         if (Attr* attr = attrs-&gt;attributeItem(i)-&gt;attr())
1427:             attr-&gt;normalize();
1428:     }
1429: }

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/dom/Element.cpp	2010/05/24 17:38:01	48050
+++ branches/WebKit/375/WebCore/dom/Element.cpp	2010/05/24 17:47:08	48051
@@ -1421,9 +1421,15 @@
     NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return;
-    unsigned numAttrs = attrs-&gt;length();
-    for (unsigned i = 0; i &lt; numAttrs; i++) {
-        if (Attr* attr = attrs-&gt;attributeItem(i)-&gt;attr())
+
+    if (attrs-&gt;isEmpty())
+        return;
+
+    Vector&lt;RefPtr&lt;Attribute&gt; &gt; attributeVector;
+    attrs-&gt;copyAttributesToVector(attributeVector);
+    size_t numAttrs = attributeVector.size();
+    for (size_t i = 0; i &lt; numAttrs; ++i) {
+        if (Attr* attr = attributeVector[i]-&gt;attr())
             attr-&gt;normalize();
     }
 }

SATE: Use-after-free vulnerability in the Element::normalizeAttributes function
in dom/Element.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows
remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
via vectors related to handlers for DOM mutation events, aka rdar problem 7948784.
NOTE: this might overlap CVE-2010-1759.
=====================================

			</explanation>
		</location>
		<grade
			severity="3"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/dom/Element.cpp
              Path ID: 29722
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:10ms:10ms
         Subject's ID: 22
   Subject identified: CVE-2010-2300
Resultset: Raw ResultSet data:
[[24:752.8651146714533:ID=24, outcome=752.8651146714533], [23:413.7038827192207:ID=23, outcome=413.7038827192207], [21:384.82296045616033:ID=21, outcome=384.82296045616033], [18:575.3837488752738:ID=18, outcome=575.3837488752738], [25:599.7570127683828:ID=25, outcome=599.7570127683828], [19:484.79320994353134:ID=19, outcome=484.79320994353134], [27:380.48590176660315:ID=27, outcome=380.48590176660315], [22:0.0:ID=22, outcome=0.0], [20:0.0:ID=20, outcome=0.0]]

Sorted data:
([22:0.0:ID=22, outcome=0.0],[20:0.0:ID=20, outcome=0.0],[27:380.48590176660315:ID=27, outcome=380.48590176660315],[21:384.82296045616033:ID=21, outcome=384.82296045616033],[23:413.7038827192207:ID=23, outcome=413.7038827192207],[19:484.79320994353134:ID=19, outcome=484.79320994353134],[18:575.3837488752738:ID=18, outcome=575.3837488752738],[25:599.7570127683828:ID=25, outcome=599.7570127683828],[24:752.8651146714533:ID=24, outcome=752.8651146714533])
Expected subject's ID: 22 (possible: [22, 20])
     Expected subject: CVE-2010-2300
       Second Best ID: 20
     Second Best Name: CVE-2010-2302
            Date/time: Tue Sep 07 05:02:53 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="9" tool_specific_id="9">
		<name cweid="399">Resource Management Errors (CWE-399)</name>
		<location id="29722" line="937" path="chrome-5.0.375.54/third_party/WebKit/WebCore/dom/Element.cpp">
			<fragment>
932:                 newStyle-&gt;setChildrenAffectedByLastChildRules();
933:             if (currentStyle-&gt;childrenAffectedByDirectAdjacentRules())
934:                 newStyle-&gt;setChildrenAffectedByDirectAdjacentRules();
935:         }
936: 
937:         if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get())) {
938:             setRenderStyle(newStyle);
939:         } else if (needsStyleRecalc() &amp;&amp; (styleChangeType() != SyntheticStyleChange) &amp;&amp; (document()-&gt;usesSiblingRules() || document()-&gt;usesDescendantRules())) {
940:             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
941:             // fooled into believing this style is the same.  This is only necessary if the document actually uses
942:             // sibling/descendant rules, since otherwise it isn't possible for ancestor styles to affect sharing of

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
--- branches/WebKit/375/WebCore/dom/Element.cpp	2010/05/25 01:07:45	48112
+++ branches/WebKit/375/WebCore/dom/Element.cpp	2010/05/25 01:21:40	48113
@@ -934,7 +934,7 @@
             newStyle-&gt;setChildrenAffectedByDirectAdjacentRules();
         }
                           
-        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get())) {
+        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get()) || change == Force &amp;&amp; renderer() &amp;&amp; renderer()-&gt;requiresForcedStyleRecalcPropagation()) {
             setRenderStyle(newStyle);
         } else if (needsStyleRecalc() &amp;&amp; (styleChangeType() != SyntheticStyleChange) &amp;&amp; (document()-&gt;usesSiblingRules() || document()-&gt;usesDescendantRules())) {
         // Although no change occurred, we use the new style so that the cousin style sharing code won't get

SATE: A vulnerability in webcore (found within the webkit rendering engine) allows remote attackers to cause memory
corruption and execute arbitrary code by using remote fonts in conjunction with DOM trees
=====================================

			</explanation>
		</location>
		<grade
			severity="3"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/dom/Element.cpp
              Path ID: 29722
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:10ms:10ms
         Subject's ID: 20
   Subject identified: CVE-2010-2302
Resultset: Raw ResultSet data:
[[24:752.8651146714533:ID=24, outcome=752.8651146714533], [23:413.7038827192207:ID=23, outcome=413.7038827192207], [21:384.82296045616033:ID=21, outcome=384.82296045616033], [18:575.3837488752738:ID=18, outcome=575.3837488752738], [25:599.7570127683828:ID=25, outcome=599.7570127683828], [19:484.79320994353134:ID=19, outcome=484.79320994353134], [27:380.48590176660315:ID=27, outcome=380.48590176660315], [22:0.0:ID=22, outcome=0.0], [20:0.0:ID=20, outcome=0.0]]

Sorted data:
([22:0.0:ID=22, outcome=0.0],[20:0.0:ID=20, outcome=0.0],[27:380.48590176660315:ID=27, outcome=380.48590176660315],[21:384.82296045616033:ID=21, outcome=384.82296045616033],[23:413.7038827192207:ID=23, outcome=413.7038827192207],[19:484.79320994353134:ID=19, outcome=484.79320994353134],[18:575.3837488752738:ID=18, outcome=575.3837488752738],[25:599.7570127683828:ID=25, outcome=599.7570127683828],[24:752.8651146714533:ID=24, outcome=752.8651146714533])
Expected subject's ID: 20 (possible: [22, 20])
     Expected subject: CVE-2010-2302
       Second Best ID: 20
     Second Best Name: CVE-2010-2302
            Date/time: Tue Sep 07 05:02:53 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="10" tool_specific_id="10">
		<name cweid="998">Other (NVD-CWE-Other)</name>
		<location id="30029" line="245" path="chrome-5.0.375.54/third_party/WebKit/WebCore/html/HTMLFrameElementBase.cpp">
			<fragment>
240: }
241: 
242: void HTMLFrameElementBase::setFocus(bool received)
243: {
244:     HTMLFrameOwnerElement::setFocus(received);
245:     if (Page* page = document()-&gt;page())
246:         page-&gt;focusController()-&gt;setFocusedFrame(received ? contentFrame() : 0);
247: }
248: 
249: bool HTMLFrameElementBase::isURLAttribute(Attribute *attr) const
250: {

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.ChebyshevDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
SATE: page/EventHandler.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 does not
properly handle a change of the focused frame during the dispatching of keydown, which allows
user-assisted remote attackers to redirect keystrokes via a crafted HTML document, aka rdar problem
7018610. NOTE: this might overlap CVE-2010-1422.
=====================================

			</explanation>
		</location>
		<grade
			severity="5"
			probability="0.0035671756297297233"
			tool_specific_rank="280.3338281596658"
		/>
		<output>
			<textoutput>
			
                 File: chrome-5.0.375.54/third_party/WebKit/WebCore/html/HTMLFrameElementBase.cpp
              Path ID: 30029
               Config: -nopreprep -raw -fft -cheb 
      Processing time: 0d:0h:0m:0s:4ms:4ms
         Subject's ID: 27
   Subject identified: CVE-2010-2295
Resultset: Raw ResultSet data:
[[24:898.793035893659:ID=24, outcome=898.793035893659], [23:581.4340316991882:ID=23, outcome=581.4340316991882], [21:633.1805719513392:ID=21, outcome=633.1805719513392], [18:742.4785115846115:ID=18, outcome=742.4785115846115], [25:770.284878263842:ID=25, outcome=770.284878263842], [19:684.5763122166048:ID=19, outcome=684.5763122166048], [27:280.3338281596658:ID=27, outcome=280.3338281596658], [22:582.2147026701017:ID=22, outcome=582.2147026701017], [20:582.2147026701017:ID=20, outcome=582.2147026701017]]

Sorted data:
([27:280.3338281596658:ID=27, outcome=280.3338281596658],[23:581.4340316991882:ID=23, outcome=581.4340316991882],[22:582.2147026701017:ID=22, outcome=582.2147026701017],[20:582.2147026701017:ID=20, outcome=582.2147026701017],[21:633.1805719513392:ID=21, outcome=633.1805719513392],[19:684.5763122166048:ID=19, outcome=684.5763122166048],[18:742.4785115846115:ID=18, outcome=742.4785115846115],[25:770.284878263842:ID=25, outcome=770.284878263842],[24:898.793035893659:ID=24, outcome=898.793035893659])
Expected subject's ID: 27 (possible: [27])
     Expected subject: CVE-2010-2295
       Second Best ID: 23
     Second Best Name: CVE-2010-2299
            Date/time: Tue Sep 07 05:02:55 EDT 2010
Outcome o (classifier-specific): 280.3338281596658
             Distance threshold: 0.1
           Computed raw P = 1/o: 0.0035671756297297233
         Warning to be reported: true
          Computed normalized P: 0.0035671756297297233

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
</report>
