Prevent unlimited iteration in the case of invalid path data.

Reviewed by Niko.

The only path commands that can leave numbers trailing the command processing
are 'm' and 'M', in which trailing numbers are parsed as arguments to an
implicit lineto command.  In any case we should just terminate as an invalid
path.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28574 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index a089d43e75cdcc6c473bb4f59f99d2fd47fa53e1..2ea68ae76639a12a3ce321366b6f818c8a9102f7 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2007-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Niko.
+
+        Prevent unlimited iteration in the case of invalid path data.
+        
+        The only path commands that can leave numbers trailing the command processing
+        are 'm' and 'M', in which trailing numbers are parsed as arguments to an
+        implicit lineto command.  In any case we should just terminate as an invalid
+        path.
+
+        * svg/dom/path-parser-expected.txt:
+        * svg/dom/path-parser.html:
+
 2007-12-08  Sam Weinig  <sam@webkit.org>
 
         Rubber-stamped by Adam Roben.

diff --git a/LayoutTests/svg/dom/path-parser-expected.txt b/LayoutTests/svg/dom/path-parser-expected.txt
index 75d3aec3b97400700baab465f5f2b30bc13083a9..7cd749877ee6e882598cbc1656064169b2c6d381 100644 (file)
--- a/LayoutTests/svg/dom/path-parser-expected.txt
+++ b/LayoutTests/svg/dom/path-parser-expected.txt
@@ -458,6 +458,7 @@ Parsed as 7 command(s) [MCCCCZC]: M1,1a9,2 6 1 2 2 2,za9 0 2 8,2,3,3 s5,8,8 1,HC
 Could not parse: 
 Could not parse: M
 Could not parse: M
+Parsed as 2 command(s) [MZ]: M1,1Z0
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/LayoutTests/svg/dom/path-parser.html b/LayoutTests/svg/dom/path-parser.html
index a2a5aad65be8e1d23f9758f401043f2019029df4..1617b4b44e0f52db8363f84009e29a7c223e9240 100644 (file)
--- a/LayoutTests/svg/dom/path-parser.html
+++ b/LayoutTests/svg/dom/path-parser.html
@@ -85,13 +85,13 @@
             }
             parsePath(pathString);
         }
-
         // Empty-ish paths
         parsePath("");
         parsePath("M");
         parsePath("M" + String.fromCharCode(0));
+        // Edge case paths:
+        parsePath("M1,1Z0");
     }
-    
     fuzz();
 
     successfullyParsed = true;

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index d8439f31921c5c0c53c4635eaa1ae49e7e6280ee..7983bc79bbe92183dd3219c8869f58a527d0d275 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2007-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Niko.
+
+        Prevent unlimited iteration in the case of invalid path data.
+        
+        The only path commands that can leave numbers trailing the command processing
+        are 'm' and 'M', in which trailing numbers are parsed as arguments to an
+        implicit lineto command.  In any case we should just terminate as an invalid
+        path.
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
 2007-12-09  Luca Bruno  <lethalman88@gmail.com>
 
         Reviewed by Alp Toker.

diff --git a/WebCore/svg/SVGParserUtilities.cpp b/WebCore/svg/SVGParserUtilities.cpp
index 4337c30125461e6122adb450d6901e39d37b0ac4..0cfaaf4c829b0ccc20f09541c18144ff7481cce0 100644 (file)
--- a/WebCore/svg/SVGParserUtilities.cpp
+++ b/WebCore/svg/SVGParserUtilities.cpp
@@ -518,6 +518,9 @@ bool SVGPathParser::parseSVG(const String& s, bool process)
                 command = 'L';
             else if (command == 'm')
                 command = 'l';
+            else
+                // Garbage data at the end of the path
+                return false;
         } else
             command = *(ptr++);