Reviewed by Darin.

        http://bugs.webkit.org/show_bug.cgi?id=15464
        SVGLengthList allows bad values

        Be more strict with svg lengths without a unit identifier.

        Test: svg/custom/invalid-lengthlist.svg

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28563 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 30f095d804eabcd27a210c021c7d50a472be959a..1952f3153a60e42c6f7ec5e013554c760054f07e 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2007-12-08  Rob Buis  <buis@kde.org>
+
+        Reviewed by Darin.
+
+        Testcase for:
+        http://bugs.webkit.org/show_bug.cgi?id=15464
+        SVGLengthList allows bad values
+
+        * svg/custom/invalid-lengthlist-expected.checksum: Added.
+        * svg/custom/invalid-lengthlist-expected.png: Added.
+        * svg/custom/invalid-lengthlist-expected.txt: Added.
+        * svg/custom/invalid-lengthlist.svg: Added.
+        * svg/dom/length-list-parser-expected.txt:
+
 2007-12-07  Antti Koivisto  <antti@apple.com>
 
         Reviewed by Adele.

diff --git a/LayoutTests/svg/custom/invalid-lengthlist-expected.checksum b/LayoutTests/svg/custom/invalid-lengthlist-expected.checksum
new file mode 100644 (file)
index 0000000..d7323dd
--- /dev/null
+++ b/LayoutTests/svg/custom/invalid-lengthlist-expected.checksum
@@ -0,0 +1 @@
+bd02d65a2219e04ebef21e349f68a34d
\ No newline at end of file

diff --git a/LayoutTests/svg/custom/invalid-lengthlist-expected.png b/LayoutTests/svg/custom/invalid-lengthlist-expected.png
new file mode 100644 (file)
index 0000000..1e6749b
Binary files /dev/null and b/LayoutTests/svg/custom/invalid-lengthlist-expected.png differ

diff --git a/LayoutTests/svg/custom/invalid-lengthlist-expected.txt b/LayoutTests/svg/custom/invalid-lengthlist-expected.txt
new file mode 100644 (file)
index 0000000..934bbc8
--- /dev/null
+++ b/LayoutTests/svg/custom/invalid-lengthlist-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderSVGRoot {svg} at (0,0) size 374x154
+    RenderSVGContainer {g} at (0,0) size 374x154
+      RenderSVGText {text}
+      RenderPath {rect} at (0,0) size 100x100 [fill={[type=SOLID] [color=#008000]}] [data="M0.00,0.00L100.00,0.00L100.00,100.00L0.00,100.00"]
+      RenderSVGText {text} at (0,130) size 287x18 contains 1 chunk(s)
+        RenderSVGInlineText {#text} at (0,-14) size 287x18
+          chunk 1 text run 1 at (0.00,130.00) startOffset 0 endOffset 44 width 287.00: "Above a green rectangle should be displayed."
+      RenderSVGText {text} at (0,150) size 374x18 contains 1 chunk(s)
+        RenderSVGInlineText {#text} at (0,-14) size 374x18
+          chunk 1 text run 1 at (0.00,150.00) startOffset 0 endOffset 61 width 374.00: "It tests that x=\"1.2.3\" as length is not accepted. Bug 15464."

diff --git a/LayoutTests/svg/custom/invalid-lengthlist.svg b/LayoutTests/svg/custom/invalid-lengthlist.svg
new file mode 100644 (file)
index 0000000..defe12a
--- /dev/null
+++ b/LayoutTests/svg/custom/invalid-lengthlist.svg
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" onload="runTest()">
+   <script type="text/ecmascript"><![CDATA[
+       function runTest() {
+           var test = document.getElementById("test");
+           if(test.x.baseVal.numberOfItems == 0) {
+               var result = document.getElementById("result");
+               result.setAttribute("fill", "green");
+           }
+       }
+   ]]></script>
+<g>
+    <text id="test" x="1.2.3" y="20"></text>
+    <rect id="result" width="100" height="100" fill="red"/>
+    <text y="130">Above a green rectangle should be displayed.</text>
+    <text y="150">It tests that x="1.2.3" as length is not accepted. Bug 15464.</text>
+</g>
+</svg>

diff --git a/LayoutTests/svg/dom/length-list-parser-expected.txt b/LayoutTests/svg/dom/length-list-parser-expected.txt
index b03b286303d32e977c92533fb506c9cf79f26a48..c804214b0d13370289518bc62774afbd3e79850c 100644 (file)
--- a/LayoutTests/svg/dom/length-list-parser-expected.txt
+++ b/LayoutTests/svg/dom/length-list-parser-expected.txt
@@ -4,128 +4,67 @@ On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE
 
 
 Parsed as 3 length(s) [ 4, 0.252, 9 ]: 4       ,.252   +9
-Parsed as 1 length(s) [ 9.08 ]: 9.08.848e2898614e85 e-2-81709  9 468 ..9
 Parsed as 3 length(s) [ 787, 3.01, 0 ]: 787 3.01, .0,e
 Parsed as 3 length(s) [ 4, 45, -685 ]: 4,45    -685 +  26.e   +e4-
-Parsed as 2 length(s) [ 0, 6.41239e+08 ]: 0+,9231173915+,--2-36e777470
-Parsed as 1 length(s) [ 89.517 ]: 89.517.70410652,,572-970     2-. 39
 Parsed as 2 length(s) [ 823, 1 ]: 823,1
-Parsed as 2 length(s) [ -0.267, 33 ]: -00.267.7 33     e5
-Parsed as 1 length(s) [ 768 ]: 768-7 e ,847866488-446..54,+,0   21
 Parsed as 3 length(s) [ 42, 9, 624 ]: 42       9 624   0. 9 e47e52147433       7       
-Parsed as 4 length(s) [ 3, 60746, 495, 60.49 ]: 3 60746- 495   60.49 -+ 3194 .192,69-- 
-Parsed as 3 length(s) [ 489, 6.76966e+08, 2 ]: 0489e,676965885 +2
-Parsed as 5 length(s) [ 54, 858, 975, 0.33, 5 ]: 54    858+0.7e4580611 975     .33e,5  -
+Parsed as 1 length(s) [ 3 ]: 3 60746- 495      60.49 -+ 3194 .192,69-- 
+Parsed as 1 length(s) [ 54 ]: 54       858+0.7e4580611 975     .33e,5  -
 Parsed as 1 length(s) [ 0 ]: 0e1 e,9 3 589     -46+58  -5      1e68
 Parsed as 1 length(s) [ 525 ]: 525 ,.+ 252020-
-Parsed as 1 length(s) [ 7.23607e+06 ]: 7236071+672,.,+e944-.005 3131+.9
-Parsed as 1 length(s) [ 172 ]: 172e
-Parsed as 4 length(s) [ 3, 17, 6, 8 ]: 003-4-572e, 17e0-353125 6       8
-Parsed as 4 length(s) [ 919, 0, 20, 82 ]: 919+5.       +0e 20+ ,82
 Parsed as 2 length(s) [ 9036, 6 ]: 9036 6
-Parsed as 5 length(s) [ -2, 7, 2, -0, 9 ]: -2 7 2+8162 -0 9
-Parsed as 4 length(s) [ 2, 8, 684, 0 ]: 2 8+0,684 0    e 9++   3+6e,-.++979,63
-Parsed as 1 length(s) [ 62 ]: 62- +            378694944       ,.252   +91,6
-Parsed as 1 length(s) [ 9.08 ]: 9.08.848e2898614e85 e-2-81709  9 468 ..9
+Parsed as 2 length(s) [ -2, 7 ]: -2 7 2+8162 -0 9
+Parsed as 1 length(s) [ 2 ]: 2 8+0,684 0       e 9++   3+6e,-.++979,63
 Parsed as 3 length(s) [ 787, 3.01, 0 ]: 787 3.01, .0,e
 Parsed as 3 length(s) [ 4, 45, -685 ]: 4,45    -685 +  26.e   +e4-
-Parsed as 2 length(s) [ 0, 6.41239e+08 ]: 0+,9231173915+,--2-36e777470
-Parsed as 1 length(s) [ 89.517 ]: 89.517.70410652,,572-970     2-. 39
 Parsed as 2 length(s) [ 823, 1 ]: 823,1
-Parsed as 2 length(s) [ -0.267, 33 ]: -00.267.7 33     e5
-Parsed as 1 length(s) [ 768 ]: 768-7 e ,847866488-446..54,+,0   21
 Parsed as 3 length(s) [ 42, 9, 624 ]: 42       9 624   0. 9 e47e52147433       7       
-Parsed as 4 length(s) [ 3, 60746, 495, 60.49 ]: 3 60746- 495   60.49 -+ 3194 .192,69-- 
-Parsed as 3 length(s) [ 489, 6.76966e+08, 2 ]: 0489e,676965885 +2
-Parsed as 5 length(s) [ 54, 858, 975, 0.33, 5 ]: 54    858+0.7e4580611 975     .33e,5  -
+Parsed as 1 length(s) [ 3 ]: 3 60746- 495      60.49 -+ 3194 .192,69-- 
+Parsed as 1 length(s) [ 54 ]: 54       858+0.7e4580611 975     .33e,5  -
 Parsed as 1 length(s) [ 0 ]: 0e1 e,9 3 589     -46+58  -5      1e68
 Parsed as 1 length(s) [ 525 ]: 525 ,.+ 252020-
-Parsed as 1 length(s) [ 7.23607e+06 ]: 7236071+672,.,+e944-.005 3131+.9
-Parsed as 1 length(s) [ 172 ]: 172e
-Parsed as 4 length(s) [ 3, 17, 6, 8 ]: 003-4-572e, 17e0-353125 6       8
-Parsed as 4 length(s) [ 919, 0, 20, 82 ]: 919+5.       +0e 20+ ,82
 Parsed as 2 length(s) [ 9036, 6 ]: 9036 6
-Parsed as 5 length(s) [ -2, 7, 2, -0, 9 ]: -2 7 2+8162 -0 9
-Parsed as 4 length(s) [ 2, 8, 684, 0 ]: 2 8+0,684 0    e 9++   3+6e,-.++979,63
-Parsed as 1 length(s) [ 62 ]: 62- +            378694944       ,.252   +91,6
-Parsed as 1 length(s) [ 9.08 ]: 9.08.848e2898614e85 e-2-81709  9 468 ..9
+Parsed as 2 length(s) [ -2, 7 ]: -2 7 2+8162 -0 9
+Parsed as 1 length(s) [ 2 ]: 2 8+0,684 0       e 9++   3+6e,-.++979,63
 Parsed as 3 length(s) [ 787, 3.01, 0 ]: 787 3.01, .0,e
 Parsed as 3 length(s) [ 4, 45, -685 ]: 4,45    -685 +  26.e   +e4-
-Parsed as 2 length(s) [ 0, 6.41239e+08 ]: 0+,9231173915+,--2-36e777470
-Parsed as 1 length(s) [ 89.517 ]: 89.517.70410652,,572-970     2-. 39
 Parsed as 2 length(s) [ 823, 1 ]: 823,1
-Parsed as 2 length(s) [ -0.267, 33 ]: -00.267.7 33     e5
-Parsed as 1 length(s) [ 768 ]: 768-7 e ,847866488-446..54,+,0   21
 Parsed as 3 length(s) [ 42, 9, 624 ]: 42       9 624   0. 9 e47e52147433       7       
-Parsed as 4 length(s) [ 3, 60746, 495, 60.49 ]: 3 60746- 495   60.49 -+ 3194 .192,69-- 
-Parsed as 3 length(s) [ 489, 6.76966e+08, 2 ]: 0489e,676965885 +2
-Parsed as 5 length(s) [ 54, 858, 975, 0.33, 5 ]: 54    858+0.7e4580611 975     .33e,5  -
+Parsed as 1 length(s) [ 3 ]: 3 60746- 495      60.49 -+ 3194 .192,69-- 
+Parsed as 1 length(s) [ 54 ]: 54       858+0.7e4580611 975     .33e,5  -
 Parsed as 1 length(s) [ 0 ]: 0e1 e,9 3 589     -46+58  -5      1e68
 Parsed as 1 length(s) [ 525 ]: 525 ,.+ 252020-
-Parsed as 1 length(s) [ 7.23607e+06 ]: 7236071+672,.,+e944-.005 3131+.9
-Parsed as 1 length(s) [ 172 ]: 172e
-Parsed as 4 length(s) [ 3, 17, 6, 8 ]: 003-4-572e, 17e0-353125 6       8
-Parsed as 4 length(s) [ 919, 0, 20, 82 ]: 919+5.       +0e 20+ ,82
 Parsed as 2 length(s) [ 9036, 6 ]: 9036 6
-Parsed as 5 length(s) [ -2, 7, 2, -0, 9 ]: -2 7 2+8162 -0 9
-Parsed as 4 length(s) [ 2, 8, 684, 0 ]: 2 8+0,684 0    e 9++   3+6e,-.++979,63
-Parsed as 1 length(s) [ 62 ]: 62- +            378694944       ,.252   +91,6
-Parsed as 1 length(s) [ 9.08 ]: 9.08.848e2898614e85 e-2-81709  9 468 ..9
+Parsed as 2 length(s) [ -2, 7 ]: -2 7 2+8162 -0 9
+Parsed as 1 length(s) [ 2 ]: 2 8+0,684 0       e 9++   3+6e,-.++979,63
 Parsed as 3 length(s) [ 787, 3.01, 0 ]: 787 3.01, .0,e
 Parsed as 3 length(s) [ 4, 45, -685 ]: 4,45    -685 +  26.e   +e4-
-Parsed as 2 length(s) [ 0, 6.41239e+08 ]: 0+,9231173915+,--2-36e777470
-Parsed as 1 length(s) [ 89.517 ]: 89.517.70410652,,572-970     2-. 39
 Parsed as 2 length(s) [ 823, 1 ]: 823,1
-Parsed as 2 length(s) [ -0.267, 33 ]: -00.267.7 33     e5
-Parsed as 1 length(s) [ 768 ]: 768-7 e ,847866488-446..54,+,0   21
 Parsed as 3 length(s) [ 42, 9, 624 ]: 42       9 624   0. 9 e47e52147433       7       
-Parsed as 4 length(s) [ 3, 60746, 495, 60.49 ]: 3 60746- 495   60.49 -+ 3194 .192,69-- 
-Parsed as 3 length(s) [ 489, 6.76966e+08, 2 ]: 0489e,676965885 +2
-Parsed as 5 length(s) [ 54, 858, 975, 0.33, 5 ]: 54    858+0.7e4580611 975     .33e,5  -
+Parsed as 1 length(s) [ 3 ]: 3 60746- 495      60.49 -+ 3194 .192,69-- 
+Parsed as 1 length(s) [ 54 ]: 54       858+0.7e4580611 975     .33e,5  -
 Parsed as 1 length(s) [ 0 ]: 0e1 e,9 3 589     -46+58  -5      1e68
 Parsed as 1 length(s) [ 525 ]: 525 ,.+ 252020-
-Parsed as 1 length(s) [ 7.23607e+06 ]: 7236071+672,.,+e944-.005 3131+.9
-Parsed as 1 length(s) [ 172 ]: 172e
-Parsed as 4 length(s) [ 3, 17, 6, 8 ]: 003-4-572e, 17e0-353125 6       8
-Parsed as 4 length(s) [ 919, 0, 20, 82 ]: 919+5.       +0e 20+ ,82
 Parsed as 2 length(s) [ 9036, 6 ]: 9036 6
-Parsed as 5 length(s) [ -2, 7, 2, -0, 9 ]: -2 7 2+8162 -0 9
-Parsed as 4 length(s) [ 2, 8, 684, 0 ]: 2 8+0,684 0    e 9++   3+6e,-.++979,63
-Parsed as 1 length(s) [ 62 ]: 62- +            378694944       ,.252   +91,6
-Parsed as 1 length(s) [ 9.08 ]: 9.08.848e2898614e85 e-2-81709  9 468 ..9
+Parsed as 2 length(s) [ -2, 7 ]: -2 7 2+8162 -0 9
+Parsed as 1 length(s) [ 2 ]: 2 8+0,684 0       e 9++   3+6e,-.++979,63
 Parsed as 3 length(s) [ 787, 3.01, 0 ]: 787 3.01, .0,e
 Parsed as 3 length(s) [ 4, 45, -685 ]: 4,45    -685 +  26.e   +e4-
-Parsed as 2 length(s) [ 0, 6.41239e+08 ]: 0+,9231173915+,--2-36e777470
-Parsed as 1 length(s) [ 89.517 ]: 89.517.70410652,,572-970     2-. 39
 Parsed as 2 length(s) [ 823, 1 ]: 823,1
-Parsed as 2 length(s) [ -0.267, 33 ]: -00.267.7 33     e5
-Parsed as 1 length(s) [ 768 ]: 768-7 e ,847866488-446..54,+,0   21
 Parsed as 3 length(s) [ 42, 9, 624 ]: 42       9 624   0. 9 e47e52147433       7       
-Parsed as 4 length(s) [ 3, 60746, 495, 60.49 ]: 3 60746- 495   60.49 -+ 3194 .192,69-- 
-Parsed as 3 length(s) [ 489, 6.76966e+08, 2 ]: 0489e,676965885 +2
-Parsed as 5 length(s) [ 54, 858, 975, 0.33, 5 ]: 54    858+0.7e4580611 975     .33e,5  -
+Parsed as 1 length(s) [ 3 ]: 3 60746- 495      60.49 -+ 3194 .192,69-- 
+Parsed as 1 length(s) [ 54 ]: 54       858+0.7e4580611 975     .33e,5  -
 Parsed as 1 length(s) [ 0 ]: 0e1 e,9 3 589     -46+58  -5      1e68
 Parsed as 1 length(s) [ 525 ]: 525 ,.+ 252020-
-Parsed as 1 length(s) [ 7.23607e+06 ]: 7236071+672,.,+e944-.005 3131+.9
-Parsed as 1 length(s) [ 172 ]: 172e
-Parsed as 4 length(s) [ 3, 17, 6, 8 ]: 003-4-572e, 17e0-353125 6       8
-Parsed as 4 length(s) [ 919, 0, 20, 82 ]: 919+5.       +0e 20+ ,82
 Parsed as 2 length(s) [ 9036, 6 ]: 9036 6
-Parsed as 5 length(s) [ -2, 7, 2, -0, 9 ]: -2 7 2+8162 -0 9
-Parsed as 4 length(s) [ 2, 8, 684, 0 ]: 2 8+0,684 0    e 9++   3+6e,-.++979,63
-Parsed as 1 length(s) [ 62 ]: 62- +            378694944       ,.252   +91,6
-Parsed as 1 length(s) [ 9.08 ]: 9.08.848e2898614e85 e-2-81709  9 468 ..9
+Parsed as 2 length(s) [ -2, 7 ]: -2 7 2+8162 -0 9
+Parsed as 1 length(s) [ 2 ]: 2 8+0,684 0       e 9++   3+6e,-.++979,63
 Parsed as 3 length(s) [ 787, 3.01, 0 ]: 787 3.01, .0,e
 Parsed as 3 length(s) [ 4, 45, -685 ]: 4,45    -685 +  26.e   +e4-
-Parsed as 2 length(s) [ 0, 6.41239e+08 ]: 0+,9231173915+,--2-36e777470
-Parsed as 1 length(s) [ 89.517 ]: 89.517.70410652,,572-970     2-. 39
 Parsed as 2 length(s) [ 823, 1 ]: 823,1
-Parsed as 2 length(s) [ -0.267, 33 ]: -00.267.7 33     e5
-Parsed as 1 length(s) [ 768 ]: 768-7 e ,847866488-446..54,+,0   21
 Parsed as 3 length(s) [ 42, 9, 624 ]: 42       9 624   0. 9 e47e52147433       7       
-Parsed as 4 length(s) [ 3, 60746, 495, 60.49 ]: 3 60746- 495   60.49 -+ 3194 .192,69-- 
-Parsed as 3 length(s) [ 489, 6.76966e+08, 2 ]: 0489e,676965885 +2
-Parsed as 5 length(s) [ 54, 858, 975, 0.33, 5 ]: 54    858+0.7e4580611 975     .33e,5  -
+Parsed as 1 length(s) [ 3 ]: 3 60746- 495      60.49 -+ 3194 .192,69-- 
+Parsed as 1 length(s) [ 54 ]: 54       858+0.7e4580611 975     .33e,5  -
 Parsed as 1 length(s) [ 0 ]: 0e1 e,9 3 589     -46+58  -5      1e68
 PASS successfullyParsed is true
 

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 686d0ccb43779635f6381225fdb650ac817c32a9..76d2237f3208625d454d5ba2d1321c8e5062d929 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2007-12-08  Rob Buis  <buis@kde.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15464
+        SVGLengthList allows bad values
+
+        Be more strict with svg lengths without a unit identifier.
+
+        Test: svg/custom/invalid-lengthlist.svg
+
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::setValueAsString):
+
 2007-12-08  Rob Buis  <buis@kde.org>
 
         Mac Tiger build fix.

diff --git a/WebCore/svg/SVGLength.cpp b/WebCore/svg/SVGLength.cpp
index 1c3d1675b9f7911154cbc75785bf5ff6fab449a7..bb66aadac4acf0a19ece7eac25be9881ba6c68ca 100644 (file)
--- a/WebCore/svg/SVGLength.cpp
+++ b/WebCore/svg/SVGLength.cpp
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005, 2006 Rob Buis <buis@kde.org>
+                  2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
                   2007 Apple Inc.  All rights reserved.
 
     This file is part of the KDE project
@@ -243,11 +243,15 @@ bool SVGLength::setValueAsString(const String& s)
     float convertedNumber = 0.0f;
     const UChar* ptr = s.characters();
     const UChar* end = ptr + s.length();
-    
+
     if (!parseNumber(ptr, end, convertedNumber, false))
         return false;
 
-    m_unit = storeUnit(extractMode(m_unit), stringToLengthType(s));
+    SVGLengthType type = stringToLengthType(s);
+    if (ptr != end && type == LengthTypeNumber)
+        return false;
+
+    m_unit = storeUnit(extractMode(m_unit), type);
     m_valueInSpecifiedUnits = convertedNumber;
     return true;
 }