Changeset 10959 in webkit


Ignore:
Timestamp:
Oct 25, 2005, 3:26:30 PM (20 years ago)
Author:
bdakin
Message:

* empty log message *

Location:
trunk
Files:
4 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r10956 r10959  
     12005-10-25  Beth Dakin  <bdakin@apple.com>
     2
     3        Layout test for <rdar://problem/4148730> SureSec si#182 safari heap overflow
     4        The fix is in WebCore.
     5
     6        * fast/table/giantRowspan-expected.checksum: Added.
     7        * fast/table/giantRowspan-expected.png: Added.
     8        * fast/table/giantRowspan-expected.txt: Added.
     9        * fast/table/giantRowspan.html: Added.
     10
    1112005-10-25  Vicki Murley  <vicki@apple.com>
    212

  • trunk/WebCore/ChangeLog-2005-12-19

    r10957 r10959  
     12005-10-25  Beth Dakin  <bdakin@apple.com>
     2
     3        Reviewed by Maciej
     4
     5        Fix for <rdar://problem/4148730> SureSec si#182 safari heap overflow.
     6        When a table has a really huge rowSpan, Safari used to crash because
     7        the malloc of the grid for the table failed. This fix just checks for
     8        the success of the malloc.
     9
     10        * khtml/rendering/render_table.cpp:
     11        (RenderTableSection::ensureRows): Return false if the grid resize is not
     12        successful.
     13        (RenderTableSection::addCell): Return early if ensureRows() returned false.
     14        * khtml/rendering/render_table.h: Make ensureRows() return a bool instead
     15        of void.
     16
    1172005-10-25  Adele Peterson  <adele@apple.com>
    218

  • trunk/WebCore/khtml/rendering/render_table.cpp

    r10755 r10959  
    903903}
    904904
    905 void RenderTableSection::ensureRows(int numRows)
     905bool RenderTableSection::ensureRows(int numRows)
    906906{
    907907    int nRows = gridRows;
    908908    if (numRows > nRows) {
    909909        if (numRows > static_cast<int>(grid.size()))
    910             grid.resize(numRows*2+1);
     910            if (!grid.resize(numRows*2+1))
     911                return false;
    911912
    912913        gridRows = numRows;
    … …  
    920921    }
    921922
     923    return true;
    922924}
    923925
    … …  
    992994
    993995    // make sure we have enough rows
    994     ensureRows( cRow + rSpan );
     996    if (!ensureRows( cRow + rSpan ))
     997        return;
    995998
    996999    int col = cCol;

  • trunk/WebCore/khtml/rendering/render_table.h

    r10755 r10959  
    268268    void recalcCells();
    269269protected:
    270     void ensureRows( int numRows );
     270    bool ensureRows(int numRows);
    271271    void clearGrid();
    272272};
Note: See TracChangeset for help on using the changeset viewer.