Changeset 20375 in webkit
- Timestamp:
- Mar 21, 2007 8:37:25 PM (17 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r20374 r20375 1 2007-03-21 Geoffrey Garen <ggaren@apple.com> 2 3 Reviewed by Beth Dakin. 4 5 Added fuzz tester for the path parser. 6 7 * svg/dom/path-parser-expected.txt: Added. 8 * svg/dom/path-parser.html: Added. 9 1 10 2007-03-21 Geoffrey Garen <ggaren@apple.com> 2 11 -
trunk/WebCore/ChangeLog
r20370 r20375 1 2007-03-21 Geoffrey Garen <ggaren@apple.com> 2 3 Reviewed by Beth Dakin. 4 5 Fixed <rdar://problem/5079410> SVG path parser hangs, exhausts memory when 6 running fuzzer test 7 8 * ksvg2/svg/SVGParserUtilities.cpp: 9 (WebCore::SVGPathParser::parseSVG): Don't assume that extra digits are 10 always preceded by an 'M' or an 'm'. 11 1 12 2007-03-21 John Sullivan <sullivan@apple.com> 2 13 -
trunk/WebCore/ksvg2/svg/SVGParserUtilities.cpp
r20364 r20375 422 422 return true; 423 423 424 if (*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9')) { 425 // there are still coords in this command 426 if (command == 'M') 427 command = 'L'; 428 else if (command == 'm') 429 command = 'l'; 430 } else 424 // Mx,y,x,y => Mx,y Lx,y 425 if ((command == 'M') && (*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9'))) 426 command = 'L'; 427 else if ((command == 'm') && (*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9'))) 428 command = 'l'; 429 else 431 430 command = *(ptr++); 432 431
Note: See TracChangeset
for help on using the changeset viewer.