nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/svg/animations/animate-calcMode-spline-cra...

2 lines
74 B
Plaintext
Raw Permalink Normal View History

OOB Read in WebCore::SVGAnimationElement https://bugs.webkit.org/show_bug.cgi?id=65858 Patch by Ken Buchanan <kenrb@chromium.org> on 2011-08-20 Reviewed by Nikolas Zimmermann. Source/WebCore: Potential crash resulting from incorrect keySpline array lengths. This fix validates the length in startedActiveInterval. Test: svg/animations/animate-calcMode-spline-crash-bad-array-length.xhtml * svg/SVGAnimationElement.cpp: (WebCore::SVGAnimationElement::parseMappedAttribute): (WebCore::SVGAnimationElement::calculateKeyTimesIndex): LayoutTests: Added test case covering keySpline array length problem. * svg/animations/animate-calcMode-spline-crash-bad-array-length-expected.txt: Added. * svg/animations/animate-calcMode-spline-crash-bad-array-length.xhtml: Added. Canonical link: https://commits.webkit.org/82466@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@93477 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2011-08-20 07:30:57 +00:00
PASS, if DumpRenderTree doesn't crash, and no assertion in a Debug build.