Title: [200027] releases/WebKitGTK/webkit-2.12/Source/WebCore
- Revision
- 200027
- Author
- [email protected]
- Date
- 2016-04-25 08:55:51 -0700 (Mon, 25 Apr 2016)
Log Message
Merge r199781 - Potential overflow in RenderLayer::hitTestList()
https://bugs.webkit.org/show_bug.cgi?id=156804
Reviewed by Simon Fraser.
Use size_t type instead of int to iterate over the Vector to make sure
we don't overflow. This is a speculative fix for <rdar://problem/23249479>.
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::hitTestList):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (200026 => 200027)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-25 15:54:34 UTC (rev 200026)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-25 15:55:51 UTC (rev 200027)
@@ -1,3 +1,16 @@
+2016-04-20 Chris Dumez <[email protected]>
+
+ Potential overflow in RenderLayer::hitTestList()
+ https://bugs.webkit.org/show_bug.cgi?id=156804
+
+ Reviewed by Simon Fraser.
+
+ Use size_t type instead of int to iterate over the Vector to make sure
+ we don't overflow. This is a speculative fix for <rdar://problem/23249479>.
+
+ * rendering/RenderLayer.cpp:
+ (WebCore::RenderLayer::hitTestList):
+
2016-04-20 Carlos Garcia Campos <[email protected]>
[Cairo] Crash in GraphicsContext::drawFocusRing when painting is disabled
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/rendering/RenderLayer.cpp (200026 => 200027)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/rendering/RenderLayer.cpp 2016-04-25 15:54:34 UTC (rev 200026)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/rendering/RenderLayer.cpp 2016-04-25 15:55:51 UTC (rev 200027)
@@ -5339,8 +5339,8 @@
return nullptr;
RenderLayer* resultLayer = nullptr;
- for (int i = list->size() - 1; i >= 0; --i) {
- RenderLayer* childLayer = list->at(i);
+ for (size_t i = list->size(); i > 0; --i) {
+ RenderLayer* childLayer = list->at(i - 1);
if (childLayer->isFlowThreadCollectingGraphicsLayersUnderRegions())
continue;
RenderLayer* hitLayer = nullptr;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
