Title: [102089] trunk
- Revision
- 102089
- Author
- [email protected]
- Date
- 2011-12-05 20:46:01 -0800 (Mon, 05 Dec 2011)
Log Message
Heap-buffer-overflow in WebCore::HTMLTreeBuilder::processEndTag
https://bugs.webkit.org/show_bug.cgi?id=73765
Patch by Florin Malita <[email protected]> on 2011-12-05
Reviewed by Adam Barth.
Source/WebCore:
Test: fast/parser/foreign-content-crash.html
Use m_tree.currentNode() instead of m_tree.currentElement() as the top node is not always an Element.
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processEndTag):
LayoutTests:
* fast/parser/foreign-content-crash-expected.txt: Added.
* fast/parser/foreign-content-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (102088 => 102089)
--- trunk/LayoutTests/ChangeLog 2011-12-06 04:16:28 UTC (rev 102088)
+++ trunk/LayoutTests/ChangeLog 2011-12-06 04:46:01 UTC (rev 102089)
@@ -1,3 +1,13 @@
+2011-12-05 Florin Malita <[email protected]>
+
+ Heap-buffer-overflow in WebCore::HTMLTreeBuilder::processEndTag
+ https://bugs.webkit.org/show_bug.cgi?id=73765
+
+ Reviewed by Adam Barth.
+
+ * fast/parser/foreign-content-crash-expected.txt: Added.
+ * fast/parser/foreign-content-crash.html: Added.
+
2011-12-05 Tim Horton <[email protected]>
Unreviewed extremely minor SVG filter pixel rebaselines for Lion.
Added: trunk/LayoutTests/fast/parser/foreign-content-crash-expected.txt (0 => 102089)
--- trunk/LayoutTests/fast/parser/foreign-content-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/parser/foreign-content-crash-expected.txt 2011-12-06 04:46:01 UTC (rev 102089)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: trunk/LayoutTests/fast/parser/foreign-content-crash.html (0 => 102089)
--- trunk/LayoutTests/fast/parser/foreign-content-crash.html (rev 0)
+++ trunk/LayoutTests/fast/parser/foreign-content-crash.html 2011-12-06 04:46:01 UTC (rev 102089)
@@ -0,0 +1,8 @@
+<script>
+ var svgElement = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+ svgElement.appendChild(document.createElement("div")).insertAdjacentHTML("beforeBegin", "</p>");
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+<p>This test passes if it doesn't crash.</p>
Modified: trunk/Source/WebCore/ChangeLog (102088 => 102089)
--- trunk/Source/WebCore/ChangeLog 2011-12-06 04:16:28 UTC (rev 102088)
+++ trunk/Source/WebCore/ChangeLog 2011-12-06 04:46:01 UTC (rev 102089)
@@ -1,3 +1,17 @@
+2011-12-05 Florin Malita <[email protected]>
+
+ Heap-buffer-overflow in WebCore::HTMLTreeBuilder::processEndTag
+ https://bugs.webkit.org/show_bug.cgi?id=73765
+
+ Reviewed by Adam Barth.
+
+ Test: fast/parser/foreign-content-crash.html
+
+ Use m_tree.currentNode() instead of m_tree.currentElement() as the top node is not always an Element.
+
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::processEndTag):
+
2011-12-05 Stephen White <[email protected]>
Allow the ImageBuffers used by SVG filters to be accelerated
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (102088 => 102089)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2011-12-06 04:16:28 UTC (rev 102088)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2011-12-06 04:46:01 UTC (rev 102089)
@@ -2313,7 +2313,7 @@
processEndTag(token);
break;
case InForeignContentMode:
- if (m_tree.currentElement()->namespaceURI() == SVGNames::svgNamespaceURI)
+ if (m_tree.currentNode()->namespaceURI() == SVGNames::svgNamespaceURI)
adjustSVGTagNameCase(token);
if (token.name() == SVGNames::scriptTag && m_tree.currentNode()->hasTagName(SVGNames::scriptTag)) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
