Title: [179783] trunk/Source/WebCore
- Revision
- 179783
- Author
- [email protected]
- Date
- 2015-02-07 12:21:24 -0800 (Sat, 07 Feb 2015)
Log Message
ASan complains about plugins/snapshotting/snapshot-plugin-not-quite-blocked-by-image.html
https://bugs.webkit.org/show_bug.cgi?id=141352
rdar://problem/19717490
Reviewed by Anders Carlsson.
* dom/Document.cpp: (WebCore::Document::ensurePlugInsInjectedScript): This string
is not null terminated.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (179782 => 179783)
--- trunk/Source/WebCore/ChangeLog 2015-02-07 19:50:42 UTC (rev 179782)
+++ trunk/Source/WebCore/ChangeLog 2015-02-07 20:21:24 UTC (rev 179783)
@@ -1,3 +1,14 @@
+2015-02-07 Alexey Proskuryakov <[email protected]>
+
+ ASan complains about plugins/snapshotting/snapshot-plugin-not-quite-blocked-by-image.html
+ https://bugs.webkit.org/show_bug.cgi?id=141352
+ rdar://problem/19717490
+
+ Reviewed by Anders Carlsson.
+
+ * dom/Document.cpp: (WebCore::Document::ensurePlugInsInjectedScript): This string
+ is not null terminated.
+
2015-02-06 Zalan Bujtas <[email protected]>
ASSERT repaintContainer->hasLayer() in WebCore::RenderObject::repaintUsingContainer
Modified: trunk/Source/WebCore/dom/Document.cpp (179782 => 179783)
--- trunk/Source/WebCore/dom/Document.cpp 2015-02-07 19:50:42 UTC (rev 179782)
+++ trunk/Source/WebCore/dom/Document.cpp 2015-02-07 20:21:24 UTC (rev 179783)
@@ -6271,7 +6271,7 @@
// Use the JS file provided by the Chrome client, or fallback to the default one.
String jsString = page()->chrome().client().plugInExtraScript();
if (!jsString)
- jsString = plugInsJavaScript;
+ jsString = String(plugInsJavaScript, sizeof(plugInsJavaScript));
m_frame->mainFrame().script().evaluateInWorld(ScriptSourceCode(jsString), world);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
