Changeset 74321 in webkit

Timestamp:

Dec 18, 2010 10:51:21 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2010-12-18 Tom Sepez <​tsepez@chromium.org>

Reviewed by David Levin.

​https://bugs.webkit.org/show_bug.cgi?id=51055
Fix a null de-reference when an XML file contains a malformed entity
of the form "&:;".

• fast/parser/resources/xml-colon-entity.xml: Added.
• fast/parser/xml-colon-entity-expected.txt: Added.
• fast/parser/xml-colon-entity.html: Added.

2010-12-18 Tom Sepez <​tsepez@chromium.org>

Reviewed by David Levin.

​https://bugs.webkit.org/show_bug.cgi?id=51055
Fix a null de-reference when an XML file contains a malformed entity
of the form "&:;".

Test: fast/parser/xml-colon-entity.html

• html/parser/HTMLEntitySearch.cpp: (WebCore::HTMLEntitySearch::advance):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/parser/resources/xml-colon-entity.xml (added)
• LayoutTests/fast/parser/xml-colon-entity-expected.txt (added)
• LayoutTests/fast/parser/xml-colon-entity.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/parser/HTMLEntitySearch.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-12-18  Tom Sepez  <tsepez@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51055
+        Fix a null de-reference when an XML file contains a malformed entity
+        of the form "&:;".
+
+        * fast/parser/resources/xml-colon-entity.xml: Added.
+        * fast/parser/xml-colon-entity-expected.txt: Added.
+        * fast/parser/xml-colon-entity.html: Added.
+
 2010-12-18  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-12-18  Tom Sepez  <tsepez@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51055
+        Fix a null de-reference when an XML file contains a malformed entity
+        of the form "&:;".
+
+        Test: fast/parser/xml-colon-entity.html
+
+        * html/parser/HTMLEntitySearch.cpp:
+        (WebCore::HTMLEntitySearch::advance):
+
 2010-12-18  Noel Gordon  <noel.gordon@gmail.com>
 

trunk/WebCore/html/parser/HTMLEntitySearch.cpp

@@ -115 +115 @@
         m_first = HTMLEntityTable::firstEntryStartingWith(nextCharacter);
         m_last = HTMLEntityTable::lastEntryStartingWith(nextCharacter);
+        if (!m_first || !m_last)
+            return fail();
     } else {
         m_first = findFirst(nextCharacter);