Prevent unlimited iteration in the case of invalid path data.

Reviewed by Niko.

The only path commands that can leave numbers trailing the command processing
are 'm' and 'M', in which trailing numbers are parsed as arguments to an
implicit lineto command.  In any case we should just terminate as an invalid
path.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28574 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index a089d43..2ea68ae 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2007-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Niko.
+
+        Prevent unlimited iteration in the case of invalid path data.
+        
+        The only path commands that can leave numbers trailing the command processing
+        are 'm' and 'M', in which trailing numbers are parsed as arguments to an
+        implicit lineto command.  In any case we should just terminate as an invalid
+        path.
+
+        * svg/dom/path-parser-expected.txt:
+        * svg/dom/path-parser.html:
+
 2007-12-08  Sam Weinig  <sam@webkit.org>
 
         Rubber-stamped by Adam Roben.

diff --git a/LayoutTests/svg/dom/path-parser-expected.txt b/LayoutTests/svg/dom/path-parser-expected.txt
index 75d3aec..7cd7498 100644 (file)
--- a/LayoutTests/svg/dom/path-parser-expected.txt
+++ b/LayoutTests/svg/dom/path-parser-expected.txt
@@ -458,6 +458,7 @@ Parsed as 7 command(s) [MCCCCZC]: M1,1a9,2 6 1 2 2 2,za9 0 2 8,2,3,3 s5,8,8 1,HC
 Could not parse: 
 Could not parse: M
 Could not parse: M
+Parsed as 2 command(s) [MZ]: M1,1Z0
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/LayoutTests/svg/dom/path-parser.html b/LayoutTests/svg/dom/path-parser.html
index a2a5aad..1617b4b 100644 (file)
--- a/LayoutTests/svg/dom/path-parser.html
+++ b/LayoutTests/svg/dom/path-parser.html
@@ -85,13 +85,13 @@
             }
             parsePath(pathString);
         }
-
         // Empty-ish paths
         parsePath("");
         parsePath("M");
         parsePath("M" + String.fromCharCode(0));
+        // Edge case paths:
+        parsePath("M1,1Z0");
     }
-    
     fuzz();
 
     successfullyParsed = true;

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index d8439f3..7983bc7 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2007-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Niko.
+
+        Prevent unlimited iteration in the case of invalid path data.
+        
+        The only path commands that can leave numbers trailing the command processing
+        are 'm' and 'M', in which trailing numbers are parsed as arguments to an
+        implicit lineto command.  In any case we should just terminate as an invalid
+        path.
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
 2007-12-09  Luca Bruno  <lethalman88@gmail.com>
 
         Reviewed by Alp Toker.

diff --git a/WebCore/svg/SVGParserUtilities.cpp b/WebCore/svg/SVGParserUtilities.cpp
index 4337c30..0cfaaf4 100644 (file)
--- a/WebCore/svg/SVGParserUtilities.cpp
+++ b/WebCore/svg/SVGParserUtilities.cpp
@@ -518,6 +518,9 @@ bool SVGPathParser::parseSVG(const String& s, bool process)
                 command = 'L';
             else if (command == 'm')
                 command = 'l';
+            else
+                // Garbage data at the end of the path
+                return false;
         } else
             command = *(ptr++);