Title: [90908] trunk/Source/WebCore
- Revision
- 90908
- Author
- [email protected]
- Date
- 2011-07-13 05:54:52 -0700 (Wed, 13 Jul 2011)
Log Message
2011-07-13 Nikolas Zimmermann <[email protected]>
Regression: OOB read in svg text run
https://bugs.webkit.org/show_bug.cgi?id=63627
Not reviewed.
Fixed last minute typo leading to assertions.
* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::paintSelection):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (90907 => 90908)
--- trunk/Source/WebCore/ChangeLog 2011-07-13 12:32:30 UTC (rev 90907)
+++ trunk/Source/WebCore/ChangeLog 2011-07-13 12:54:52 UTC (rev 90908)
@@ -1,3 +1,15 @@
+2011-07-13 Nikolas Zimmermann <[email protected]>
+
+ Regression: OOB read in svg text run
+ https://bugs.webkit.org/show_bug.cgi?id=63627
+
+ Not reviewed.
+
+ Fixed last minute typo leading to assertions.
+
+ * rendering/InlineTextBox.cpp:
+ (WebCore::InlineTextBox::paintSelection):
+
2011-07-12 Andrey Kosyakov <[email protected]>
Web Inspector: factor NetworkLogView out of Network panel
Modified: trunk/Source/WebCore/rendering/InlineTextBox.cpp (90907 => 90908)
--- trunk/Source/WebCore/rendering/InlineTextBox.cpp 2011-07-13 12:32:30 UTC (rev 90907)
+++ trunk/Source/WebCore/rendering/InlineTextBox.cpp 2011-07-13 12:54:52 UTC (rev 90908)
@@ -817,7 +817,7 @@
BufferForAppendingHyphen charactersWithHyphen;
bool respectHyphen = ePos == length && hasHyphen();
- TextRun textRun = constructTextRun(style, font, characters, length, textRenderer()->textLength() - length, respectHyphen ? &charactersWithHyphen : 0);
+ TextRun textRun = constructTextRun(style, font, characters, length, textRenderer()->textLength() - m_start, respectHyphen ? &charactersWithHyphen : 0);
if (respectHyphen)
ePos = textRun.length();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
