Changeset 102089 in webkit

Timestamp:

Dec 5, 2011, 8:46:01 PM (15 years ago)

Author:

commit-queue@webkit.org

Message:

Heap-buffer-overflow in WebCore::HTMLTreeBuilder::processEndTag
​https://bugs.webkit.org/show_bug.cgi?id=73765

Patch by Florin Malita <​fmalita@google.com> on 2011-12-05
Reviewed by Adam Barth.

Source/WebCore:

Test: fast/parser/foreign-content-crash.html

Use m_tree.currentNode() instead of m_tree.currentElement() as the top node is not always an Element.

• html/parser/HTMLTreeBuilder.cpp:

(WebCore::HTMLTreeBuilder::processEndTag):

LayoutTests:

• fast/parser/foreign-content-crash-expected.txt: Added.
• fast/parser/foreign-content-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/parser/foreign-content-crash-expected.txt (added)
• LayoutTests/fast/parser/foreign-content-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/parser/HTMLTreeBuilder.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-12-05  Florin Malita  <fmalita@google.com>
+
+        Heap-buffer-overflow in WebCore::HTMLTreeBuilder::processEndTag
+        https://bugs.webkit.org/show_bug.cgi?id=73765
+
+        Reviewed by Adam Barth.
+
+        * fast/parser/foreign-content-crash-expected.txt: Added.
+        * fast/parser/foreign-content-crash.html: Added.
+
 2011-12-05  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-12-05  Florin Malita  <fmalita@google.com>
+
+        Heap-buffer-overflow in WebCore::HTMLTreeBuilder::processEndTag
+        https://bugs.webkit.org/show_bug.cgi?id=73765
+
+        Reviewed by Adam Barth.
+
+        Test: fast/parser/foreign-content-crash.html
+
+        Use m_tree.currentNode() instead of m_tree.currentElement() as the top node is not always an Element.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag):
+
 2011-12-05  Stephen White  <senorblanco@chromium.org>
 

trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp

@@ -2314 +2314 @@
         break;
     case InForeignContentMode:
-        if (m_tree.currentElement()->namespaceURI() == SVGNames::svgNamespaceURI)
+        if (m_tree.currentNode()->namespaceURI() == SVGNames::svgNamespaceURI)
             adjustSVGTagNameCase(token);