guix-devel/gnu/packages/patches/icecat-CVE-2016-2819.patch

103 lines
4.7 KiB
Diff

changeset: 312054:072992bf176d
user: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Sun May 15 17:03:06 2016 +0300
summary: Bug 1270381. r=wchen. a=ritu
diff -r d30748143c21 -r 072992bf176d parser/html/javasrc/TreeBuilder.java
--- a/parser/html/javasrc/TreeBuilder.java Mon May 09 18:05:32 2016 -0700
+++ b/parser/html/javasrc/TreeBuilder.java Sun May 15 17:03:06 2016 +0300
@@ -39,6 +39,11 @@
import java.util.HashMap;
import java.util.Map;
+import org.xml.sax.ErrorHandler;
+import org.xml.sax.Locator;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXParseException;
+
import nu.validator.htmlparser.annotation.Auto;
import nu.validator.htmlparser.annotation.Const;
import nu.validator.htmlparser.annotation.IdType;
@@ -54,11 +59,6 @@
import nu.validator.htmlparser.common.TokenHandler;
import nu.validator.htmlparser.common.XmlViolationPolicy;
-import org.xml.sax.ErrorHandler;
-import org.xml.sax.Locator;
-import org.xml.sax.SAXException;
-import org.xml.sax.SAXParseException;
-
public abstract class TreeBuilder<T> implements TokenHandler,
TreeBuilderState<T> {
@@ -1924,7 +1924,6 @@
break starttagloop;
}
generateImpliedEndTags();
- // XXX is the next if dead code?
if (errorHandler != null && !isCurrent("table")) {
errNoCheckUnclosedElementsOnStack();
}
@@ -2183,11 +2182,11 @@
pop();
}
break;
- } else if (node.isSpecial()
+ } else if (eltPos == 0 || (node.isSpecial()
&& (node.ns != "http://www.w3.org/1999/xhtml"
- || (node.name != "p"
- && node.name != "address"
- && node.name != "div"))) {
+ || (node.name != "p"
+ && node.name != "address"
+ && node.name != "div")))) {
break;
}
eltPos--;
@@ -3878,7 +3877,7 @@
pop();
}
break endtagloop;
- } else if (node.isSpecial()) {
+ } else if (eltPos == 0 || node.isSpecial()) {
errStrayEndTag(name);
break endtagloop;
}
@@ -4745,6 +4744,7 @@
int furthestBlockPos = formattingEltStackPos + 1;
while (furthestBlockPos <= currentPtr) {
StackNode<T> node = stack[furthestBlockPos]; // weak ref
+ assert furthestBlockPos > 0: "How is formattingEltStackPos + 1 not > 0?";
if (node.isSpecial()) {
break;
}
diff -r d30748143c21 -r 072992bf176d parser/html/nsHtml5TreeBuilder.cpp
--- a/parser/html/nsHtml5TreeBuilder.cpp Mon May 09 18:05:32 2016 -0700
+++ b/parser/html/nsHtml5TreeBuilder.cpp Sun May 15 17:03:06 2016 +0300
@@ -1102,7 +1102,7 @@
pop();
}
break;
- } else if (node->isSpecial() && (node->ns != kNameSpaceID_XHTML || (node->name != nsHtml5Atoms::p && node->name != nsHtml5Atoms::address && node->name != nsHtml5Atoms::div))) {
+ } else if (!eltPos || (node->isSpecial() && (node->ns != kNameSpaceID_XHTML || (node->name != nsHtml5Atoms::p && node->name != nsHtml5Atoms::address && node->name != nsHtml5Atoms::div)))) {
break;
}
eltPos--;
@@ -2749,7 +2749,7 @@
pop();
}
NS_HTML5_BREAK(endtagloop);
- } else if (node->isSpecial()) {
+ } else if (!eltPos || node->isSpecial()) {
errStrayEndTag(name);
NS_HTML5_BREAK(endtagloop);
}
@@ -3593,6 +3593,7 @@
int32_t furthestBlockPos = formattingEltStackPos + 1;
while (furthestBlockPos <= currentPtr) {
nsHtml5StackNode* node = stack[furthestBlockPos];
+ MOZ_ASSERT(furthestBlockPos > 0, "How is formattingEltStackPos + 1 not > 0?");
if (node->isSpecial()) {
break;
}