diff options
Diffstat (limited to 'gnu/packages/patches/icecat-CVE-2016-2819.patch')
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-2819.patch | 102 |
1 files changed, 102 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2016-2819.patch b/gnu/packages/patches/icecat-CVE-2016-2819.patch new file mode 100644 index 0000000000..cbb833d43d --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-2819.patch @@ -0,0 +1,102 @@ + changeset: 312054:072992bf176d + user: Henri Sivonen <hsivonen@hsivonen.fi> + Date: Sun May 15 17:03:06 2016 +0300 + summary: Bug 1270381. r=wchen. a=ritu + +diff -r d30748143c21 -r 072992bf176d parser/html/javasrc/TreeBuilder.java +--- a/parser/html/javasrc/TreeBuilder.java Mon May 09 18:05:32 2016 -0700 ++++ b/parser/html/javasrc/TreeBuilder.java Sun May 15 17:03:06 2016 +0300 +@@ -39,6 +39,11 @@ + import java.util.HashMap; + import java.util.Map; + ++import org.xml.sax.ErrorHandler; ++import org.xml.sax.Locator; ++import org.xml.sax.SAXException; ++import org.xml.sax.SAXParseException; ++ + import nu.validator.htmlparser.annotation.Auto; + import nu.validator.htmlparser.annotation.Const; + import nu.validator.htmlparser.annotation.IdType; +@@ -54,11 +59,6 @@ + import nu.validator.htmlparser.common.TokenHandler; + import nu.validator.htmlparser.common.XmlViolationPolicy; + +-import org.xml.sax.ErrorHandler; +-import org.xml.sax.Locator; +-import org.xml.sax.SAXException; +-import org.xml.sax.SAXParseException; +- + public abstract class TreeBuilder<T> implements TokenHandler, + TreeBuilderState<T> { + +@@ -1924,7 +1924,6 @@ + break starttagloop; + } + generateImpliedEndTags(); +- // XXX is the next if dead code? + if (errorHandler != null && !isCurrent("table")) { + errNoCheckUnclosedElementsOnStack(); + } +@@ -2183,11 +2182,11 @@ + pop(); + } + break; +- } else if (node.isSpecial() ++ } else if (eltPos == 0 || (node.isSpecial() + && (node.ns != "http://www.w3.org/1999/xhtml" +- || (node.name != "p" +- && node.name != "address" +- && node.name != "div"))) { ++ || (node.name != "p" ++ && node.name != "address" ++ && node.name != "div")))) { + break; + } + eltPos--; +@@ -3878,7 +3877,7 @@ + pop(); + } + break endtagloop; +- } else if (node.isSpecial()) { ++ } else if (eltPos == 0 || node.isSpecial()) { + errStrayEndTag(name); + break endtagloop; + } +@@ -4745,6 +4744,7 @@ + int furthestBlockPos = formattingEltStackPos + 1; + while (furthestBlockPos <= currentPtr) { + StackNode<T> node = stack[furthestBlockPos]; // weak ref ++ assert furthestBlockPos > 0: "How is formattingEltStackPos + 1 not > 0?"; + if (node.isSpecial()) { + break; + } +diff -r d30748143c21 -r 072992bf176d parser/html/nsHtml5TreeBuilder.cpp +--- a/parser/html/nsHtml5TreeBuilder.cpp Mon May 09 18:05:32 2016 -0700 ++++ b/parser/html/nsHtml5TreeBuilder.cpp Sun May 15 17:03:06 2016 +0300 +@@ -1102,7 +1102,7 @@ + pop(); + } + break; +- } else if (node->isSpecial() && (node->ns != kNameSpaceID_XHTML || (node->name != nsHtml5Atoms::p && node->name != nsHtml5Atoms::address && node->name != nsHtml5Atoms::div))) { ++ } else if (!eltPos || (node->isSpecial() && (node->ns != kNameSpaceID_XHTML || (node->name != nsHtml5Atoms::p && node->name != nsHtml5Atoms::address && node->name != nsHtml5Atoms::div)))) { + break; + } + eltPos--; +@@ -2749,7 +2749,7 @@ + pop(); + } + NS_HTML5_BREAK(endtagloop); +- } else if (node->isSpecial()) { ++ } else if (!eltPos || node->isSpecial()) { + errStrayEndTag(name); + NS_HTML5_BREAK(endtagloop); + } +@@ -3593,6 +3593,7 @@ + int32_t furthestBlockPos = formattingEltStackPos + 1; + while (furthestBlockPos <= currentPtr) { + nsHtml5StackNode* node = stack[furthestBlockPos]; ++ MOZ_ASSERT(furthestBlockPos > 0, "How is formattingEltStackPos + 1 not > 0?"); + if (node->isSpecial()) { + break; + } |