x11-libs/qt-webkit/files/webkit-CVE-2009-1725.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Index: master/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
===================================================================
--- a/master/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/master/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -865,5 +865,7 @@
                 } else {
                     // FIXME: We should eventually colorize entities by sending them as a special token.
-                    checkBuffer(11);
+                    // 12 bytes required: up to 10 bytes in m_cBuffer plus the
+                    // leading '&' and trailing ';'
+                    checkBuffer(12);
                     *dest++ = '&';
                     for (unsigned i = 0; i < cBufferPos; i++)
@@ -876,5 +878,7 @@
                 }
             } else {
-                checkBuffer(10);
+                // 11 bytes required: up to 10 bytes in m_cBuffer plus the
+                // leading '&'
+                checkBuffer(11);
                 // ignore the sequence, add it to the buffer as plaintext
                 *dest++ = '&';