diff options
| author | Cary Clark <cary@android.com> | 2009-06-26 09:44:05 -0700 |
|---|---|---|
| committer | The Android Open Source Project <initial-contribution@android.com> | 2009-06-26 09:44:05 -0700 |
| commit | 992218c399bf3f626b965842739498500245ac8b (patch) | |
| tree | dc500f652055aa5153d0ce7384803a5bf0d23e00 /WebCore/html | |
| parent | db6d1651f2c33036d21d8f8250ba01a656d6fddc (diff) | |
| parent | 14d2a338a0dd9fe7f2e7833ce90aed2f6eef6e34 (diff) | |
| download | external_webkit-992218c399bf3f626b965842739498500245ac8b.zip external_webkit-992218c399bf3f626b965842739498500245ac8b.tar.gz external_webkit-992218c399bf3f626b965842739498500245ac8b.tar.bz2 | |
am 14d2a338: Add security fix as seen in http://trac.webkit.org/changeset/44799
Merge commit '14d2a338a0dd9fe7f2e7833ce90aed2f6eef6e34'
* commit '14d2a338a0dd9fe7f2e7833ce90aed2f6eef6e34':
Add security fix as seen in http://trac.webkit.org/changeset/44799
Diffstat (limited to 'WebCore/html')
| -rw-r--r-- | WebCore/html/HTMLTokenizer.cpp | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp index 25e9adf..413050d 100644 --- a/WebCore/html/HTMLTokenizer.cpp +++ b/WebCore/html/HTMLTokenizer.cpp @@ -876,7 +876,9 @@ HTMLTokenizer::State HTMLTokenizer::parseEntity(SegmentedString& src, UChar*& de } } else { // FIXME: We should eventually colorize entities by sending them as a special token. - checkBuffer(11); + // 12 bytes required: up to 10 bytes in m_cBuffer plus the + // leading '&' and trailing ';' + checkBuffer(12); *dest++ = '&'; for (unsigned i = 0; i < cBufferPos; i++) dest[i] = m_cBuffer[i]; @@ -887,7 +889,9 @@ HTMLTokenizer::State HTMLTokenizer::parseEntity(SegmentedString& src, UChar*& de } } } else { - checkBuffer(10); + // 11 bytes required: up to 10 bytes in m_cBuffer plus the + // leading '&' + checkBuffer(11); // ignore the sequence, add it to the buffer as plaintext *dest++ = '&'; for (unsigned i = 0; i < cBufferPos; i++) |