Changeset 57263 in webkit


Ignore:
Timestamp:
Apr 8, 2010 1:19:18 AM (14 years ago)
Author:
eric@webkit.org
Message:

2010-04-08 Chris Evans <​cevans@chromium.org>

Reviewed by Adam Barth.

Add test for SVG image with excessive nesting.
​https://bugs.webkit.org/show_bug.cgi?id=37247

  • fast/images/svg-nested.html: added
  • fast/images/svg-nested-expected.txt: added

2010-04-08 Chris Evans <​cevans@chromium.org>

Reviewed by Adam Barth.

Sanity: apply a max node depth to XML parsing.

​https://bugs.webkit.org/show_bug.cgi?id=37247

Test: fast/images/svg-nested.html

  • dom/XMLTokenizer.cpp: (WebCore::XMLTokenizer::pushCurrentNode): Error out the parse upon a really large node depth.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r57261 r57263  
     12010-04-08  Chris Evans  <cevans@chromium.org>
     2
     3        Reviewed by Adam Barth.
     4
     5        Add test for SVG image with excessive nesting.
     6        https://bugs.webkit.org/show_bug.cgi?id=37247
     7
     8        * fast/images/svg-nested.html: added
     9        * fast/images/svg-nested-expected.txt: added
     10
    1112010-04-08  Adam Barth  <abarth@webkit.org>
    212

  • trunk/WebCore/ChangeLog

    r57245 r57263  
     12010-04-08  Chris Evans  <cevans@chromium.org>
     2
     3        Reviewed by Adam Barth.
     4
     5        Sanity: apply a max node depth to XML parsing.
     6
     7        https://bugs.webkit.org/show_bug.cgi?id=37247
     8
     9        Test: fast/images/svg-nested.html
     10
     11        * dom/XMLTokenizer.cpp:
     12        (WebCore::XMLTokenizer::pushCurrentNode):
     13          Error out the parse upon a really large node depth.
     14
    1152010-04-07  Dumitru Daniliuc  <dumi@chromium.org>
    216

  • trunk/WebCore/dom/XMLTokenizer.cpp

    r56825 r57263  
    6868
    6969const int maxErrors = 25;
     70const size_t maxNestingDepth = 4096;
    7071
    7172#if ENABLE(WML)
    … …  
    8788    m_currentNodeStack.append(m_currentNode);
    8889    m_currentNode = n;
     90    if (m_currentNodeStack.size() > maxNestingDepth)
     91        handleError(fatal, "Excessive node nesting.", lineNumber(), columnNumber());
    8992}
    9093
Note: See TracChangeset for help on using the changeset viewer.