File bnc512559-2009-1690.diff of Package kdelibs4

Overview Repositories Revisions Requests Users Attributes Meta

File bnc512559-2009-1690.diff of Package kdelibs4

------------------------------------------------------------------------
r983316 | mueller | 2009-06-17 23:00:06 +0000 (Wed, 17 Jun 2009) | 2 lines
Changed paths:
   M /branches/KDE/4.2/kdelibs/khtml/html/htmlparser.cpp
   M /branches/KDE/4.2/kdelibs/khtml/html/htmlparser.h

fix crash on <head> occuring twice (CVE-2009-1690)

------------------------------------------------------------------------
Index: branches/KDE/4.2/kdelibs/khtml/html/htmlparser.h
===================================================================
--- khtml/html/htmlparser.h	(revision 983315)
+++ khtml/html/htmlparser.h	(revision 983316)
@@ -157,7 +157,7 @@
     /*
      * the head element. Needed for crappy html which defines <base> after </head>
      */
-    DOM::HTMLHeadElementImpl *head;
+    RefPtr<DOM::HTMLHeadElementImpl> head;
 
     /*
      * a possible <isindex> element in the head. Compatibility hack for
Index: branches/KDE/4.2/kdelibs/khtml/html/htmlparser.cpp
===================================================================
--- khtml/html/htmlparser.cpp	(revision 983315)
+++ khtml/html/htmlparser.cpp	(revision 983316)
@@ -216,7 +216,6 @@
 
     form = 0;
     map = 0;
-    head = 0;
     end = false;
     isindex = 0;
 
@@ -678,8 +677,7 @@
             case ID_BASE:
                 if(!head) {
                     head = new HTMLHeadElementImpl(document);
-                    e = head;
-                    insertNode(e);
+                    insertNode(head.get());
                     handled = true;
                 }
                 break;
@@ -894,7 +892,7 @@
     case ID_HEAD:
         if(!head && (current->id() == ID_HTML || current->isDocumentNode())) {
             head = new HTMLHeadElementImpl(document);
-            n = head;
+            n = head.get();
         }
         break;
     case ID_BODY:
@@ -1907,19 +1905,19 @@
     head = new HTMLHeadElementImpl(document);
     HTMLElementImpl *body = doc()->body();
     int exceptioncode = 0;
-    doc()->documentElement()->insertBefore(head, body, exceptioncode);
+    doc()->documentElement()->insertBefore(head.get(), body, exceptioncode);
     if ( exceptioncode ) {
 #ifdef PARSER_DEBUG
         kDebug( 6035 ) << "creation of head failed!!!!:" << exceptioncode;
 #endif
-        delete head;
+        delete head.get();
         head = 0;
     }
         
     // If the body does not exist yet, then the <head> should be pushed as the current block.
     if (head && !body) {
         pushBlock(head->id(), tagPriority(head->id()));
-        setCurrent(head);
+        setCurrent(head.get());
     }
 }

Places

File bnc512559-2009-1690.diff of Package kdelibs4

Places