Changeset 20375 in webkit

Timestamp:

Mar 21, 2007 8:37:25 PM (17 years ago)

Author:

ggaren

Message:

LayoutTests:

Reviewed by Beth Dakin.

Added fuzz tester for the path parser.

• svg/dom/path-parser-expected.txt: Added.
• svg/dom/path-parser.html: Added.

WebCore:

Reviewed by Beth Dakin.

Fixed <rdar://problem/5079410> SVG path parser hangs, exhausts memory when
running fuzzer test

• ksvg2/svg/SVGParserUtilities.cpp: (WebCore::SVGPathParser::parseSVG): Don't assume that extra digits are always preceded by an 'M' or an 'm'.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/dom/path-parser-expected.txt (added)
• LayoutTests/svg/dom/path-parser.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/ksvg2/svg/SVGParserUtilities.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2007-03-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Added fuzz tester for the path parser.
+
+        * svg/dom/path-parser-expected.txt: Added.
+        * svg/dom/path-parser.html: Added.
+
 2007-03-21  Geoffrey Garen  <ggaren@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2007-03-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Fixed <rdar://problem/5079410> SVG path parser hangs, exhausts memory when 
+        running fuzzer test
+
+        * ksvg2/svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG): Don't assume that extra digits are
+        always preceded by an 'M' or an 'm'.
+
 2007-03-21  John Sullivan  <sullivan@apple.com>
 

trunk/WebCore/ksvg2/svg/SVGParserUtilities.cpp

@@ -422 +422 @@
             return true;
 
-        if (*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9')) {
-            // there are still coords in this command
-            if (command == 'M')
-                command = 'L';
-            else if (command == 'm')
-                command = 'l';
-        } else
+        // Mx,y,x,y => Mx,y Lx,y
+        if ((command == 'M') && (*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9')))
+            command = 'L';
+        else if ((command == 'm') && (*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9')))
+            command = 'l';
+        else
             command = *(ptr++);