Changeset 51627 in webkit

Timestamp:

Dec 3, 2009 1:22:14 AM (14 years ago)

Author:

oliver@apple.com

Message:

NULL ptr in SVGPathSegList::getPathSegAtLength()
​https://bugs.webkit.org/show_bug.cgi?id=30313

Reviewed by Maciej Stachowiak.

Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
Add null checks to SVGList's content manipulation functions to prevent
null values from entering the list in the first place.

Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/dom/svgpath-out-of-bounds-getPathSeg-expected.txt (added)
• LayoutTests/svg/dom/svgpath-out-of-bounds-getPathSeg.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/svg/SVGList.h (modified) (4 diffs)
• WebCore/svg/SVGPathElement.cpp (modified) (1 diff)
• WebCore/svg/SVGPathElement.h (modified) (1 diff)
• WebCore/svg/SVGPathElement.idl (modified) (1 diff)
• WebCore/svg/SVGPathSegList.cpp (modified) (5 diffs)
• WebCore/svg/SVGPathSegList.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        NULL ptr in SVGPathSegList::getPathSegAtLength()
+        https://bugs.webkit.org/show_bug.cgi?id=30313
+
+        Add testcases for incorrect pathSeg usage.
+
+        * svg/dom/svgpath-out-of-bounds-getPathSeg-expected.txt: Added.
+        * svg/dom/svgpath-out-of-bounds-getPathSeg.html: Added.
+
 2009-12-02  Shinichiro Hamaji  <hamaji@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        NULL ptr in SVGPathSegList::getPathSegAtLength()
+        https://bugs.webkit.org/show_bug.cgi?id=30313
+
+        Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
+        Add null checks to SVGList's content manipulation functions to prevent
+        null values from entering the list in the first place.
+
+        Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getPathSegAtLength):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathElement.idl:
+        * svg/SVGPathSegList.cpp:
+        (WebCore::SVGPathSegList::getPathSegAtLength):
+        (WebCore::SVGPathSegList::toPathData):
+        (WebCore::SVGPathSegList::createAnimated):
+        * svg/SVGPathSegList.h:
+
 2009-12-02  Yusuke Sato  <yusukes@chromium.org>
 

trunk/WebCore/svg/SVGList.h

@@ -57 +57 @@
         Item initialize(Item newItem, ExceptionCode& ec)
         {
+            if (!newItem) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
             clear(ec);
             return appendItem(newItem, ec);
@@ -93 +97 @@
         }
 
-        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
-        {
+        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode& ec)
+        {
+            if (!newItem) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             if (index < m_vector.size()) {
                 m_vector.insert(index, newItem);
@@ -109 +118 @@
                 return TypeOperations::nullItem();
             }
+    
+            if (!newItem) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
 
             m_vector[index] = newItem;
@@ -126 +140 @@
         }
 
-        Item appendItem(Item newItem, ExceptionCode&)
-        {
+        Item appendItem(Item newItem, ExceptionCode& ec)
+        {
+            if (!newItem) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             m_vector.append(newItem);
             return newItem;

trunk/WebCore/svg/SVGPathElement.cpp

@@ -70 +70 @@
 }
 
-unsigned long SVGPathElement::getPathSegAtLength(float length)
-{
-    return pathSegList()->getPathSegAtLength(length);
+unsigned long SVGPathElement::getPathSegAtLength(float length, ExceptionCode& ec)
+{
+    return pathSegList()->getPathSegAtLength(length, ec);
 }
 

trunk/WebCore/svg/SVGPathElement.h

@@ -63 +63 @@
         float getTotalLength();
         FloatPoint getPointAtLength(float distance);
-        unsigned long getPathSegAtLength(float distance);
+        unsigned long getPathSegAtLength(float distance, ExceptionCode&);
 
         static PassRefPtr<SVGPathSegClosePath> createSVGPathSegClosePath();

trunk/WebCore/svg/SVGPathElement.idl

@@ -38 +38 @@
         float getTotalLength();
         SVGPoint getPointAtLength(in float distance);
-        unsigned long getPathSegAtLength(in float distance);
+        unsigned long getPathSegAtLength(in float distance)
+            raises(DOMException, SVGException);
 
         SVGPathSegClosePath createSVGPathSegClosePath();

trunk/WebCore/svg/SVGPathSegList.cpp

@@ -52 +52 @@
 }
 
-unsigned SVGPathSegList::getPathSegAtLength(double)
+unsigned SVGPathSegList::getPathSegAtLength(double, ExceptionCode& ec)
 {
     // FIXME : to be useful this will need to support non-normalized SVGPathSegLists
-    ExceptionCode ec = 0;
     int len = numberOfItems();
     // FIXME: Eventually this will likely move to a "path applier"-like model, until then PathTraversalState is less useful as we could just use locals
@@ -61 +60 @@
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return 0;
         float segmentLength = 0;
         switch (segment->pathSegType()) {
@@ -105 +106 @@
     // FIXME : This should also support non-normalized PathSegLists
     Path pathData;
+    int len = numberOfItems();
     ExceptionCode ec = 0;
-    int len = numberOfItems();
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return Path();
         switch (segment->pathSegType()) {
             case SVGPathSeg::PATHSEG_MOVETO_ABS:
@@ -183 +186 @@
         return 0;
     RefPtr<SVGPathSegList> result = create(fromList->associatedAttributeName());
-    ExceptionCode ec;
+    ExceptionCode ec = 0;
     for (unsigned n = 0; n < itemCount; ++n) {
         SVGPathSeg* from = fromList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         SVGPathSeg* to = toList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         if (from->pathSegType() == SVGPathSeg::PATHSEG_UNKNOWN || from->pathSegType() != to->pathSegType())
             return 0;
@@ -252 +259 @@
         }
         result->appendItem(segment, ec);
+        if (ec)
+            return 0;
     }
     return result.release();

trunk/WebCore/svg/SVGPathSegList.h

@@ -37 +37 @@
         virtual ~SVGPathSegList();
 
-        unsigned getPathSegAtLength(double);
+        unsigned getPathSegAtLength(double, ExceptionCode&);
         Path toPathData();