Changeset 50545

Timestamp:

11/04/09 22:39:41 (4 months ago)

Author:

eric@webkit.org

Message:

2009-11-04 Dan Kegel < dank@chromium.org>

Reviewed by Alexey Proskuryakov.

Fix buffer overrun in WebCore::Page::userStyleSheetLocationChanged()
 https://bugs.webkit.org/show_bug.cgi?id=31138

Test: LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html in Valgrind

• page/Page.cpp: (WebCore::Page::userStyleSheetLocationChanged):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/Page.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-11-04  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix buffer overrun in WebCore::Page::userStyleSheetLocationChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=31138
+
+        Test: LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html in Valgrind
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
 2009-11-04  Timothy Hatcher  <timothy@apple.com>
 

trunk/WebCore/page/Page.cpp

@@ -543 +543 @@
         Vector<char> styleSheetAsUTF8;
         if (base64Decode(encodedData, styleSheetAsUTF8))
-            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data());
+            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data(), styleSheetAsUTF8.size());
     }