Skip to content

GitLab

Commit 33ea1761 authored by oliver@apple.com's avatar oliver@apple.com
Browse files

NULL ptr in SVGPathSegList::getPathSegAtLength() 

https://bugs.webkit.org/show_bug.cgi?id=30313

Reviewed by Maciej Stachowiak.

Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
Add null checks to SVGList's content manipulation functions to prevent
null values from entering the list in the first place.

Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@51627 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 447f2722
Hide whitespace changes
Inline Side-by-side
Showing with 128 additions and 11 deletions
LayoutTests/ChangeLog
View file @ 33ea1761
2009-12-03 Oliver Hunt <oliver@apple.com>
Reviewed by Maciej Stachowiak.
NULL ptr in SVGPathSegList::getPathSegAtLength()
https://bugs.webkit.org/show_bug.cgi?id=30313
Add testcases for incorrect pathSeg usage.
* svg/dom/svgpath-out-of-bounds-getPathSeg-expected.txt: Added.
* svg/dom/svgpath-out-of-bounds-getPathSeg.html: Added.
2009-12-02 Shinichiro Hamaji <hamaji@chromium.org>
 
Reviewed by Darin Adler.
LayoutTests/svg/dom/svgpath-out-of-bounds-getPathSeg-expected.txt 0 → 100644
View file @ 33ea1761
Tests that an exception is thrown if we try to get a pathSeg for a length out of the bounds of the path itself.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS path.pathSegList.initialize(); threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
PASS path.getPathSegAtLength(0) is 0
PASS path.insertItemBefore(null, 0) threw exception TypeError: Result of expression 'path.insertItemBefore' [undefined] is not a function..
PASS path.replaceItem(null, 0) threw exception TypeError: Result of expression 'path.replaceItem' [undefined] is not a function..
PASS path.appendItem(null) threw exception TypeError: Result of expression 'path.appendItem' [undefined] is not a function..
List correctly initialised.
PASS path.getPathSegAtLength(0) is 0
PASS path.insertItemBefore(null, 0) threw exception TypeError: Result of expression 'path.insertItemBefore' [undefined] is not a function..
PASS path.replaceItem(null, 0) threw exception TypeError: Result of expression 'path.replaceItem' [undefined] is not a function..
PASS path.appendItem(null) threw exception TypeError: Result of expression 'path.appendItem' [undefined] is not a function..
PASS successfullyParsed is true
TEST COMPLETE
LayoutTests/svg/dom/svgpath-out-of-bounds-getPathSeg.html 0 → 100644
View file @ 33ea1761
<!DOCTYPE html>
<html>
<head>
<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
<script src="../../fast/js/resources/js-test-pre.js"></script>
</head>
<body>
<p id="description"></p>
<div id="console"></div>
<script>
description("Tests that an exception is thrown if we try to get a pathSeg for a length out of the bounds of the path itself.");
path = document.createElementNS("http://www.w3.org/2000/svg", "path");
shouldThrow("path.pathSegList.initialize();");
shouldBe("path.getPathSegAtLength(0)", '0');
shouldThrow("path.insertItemBefore(null, 0)");
shouldThrow("path.replaceItem(null, 0)");
shouldThrow("path.appendItem(null)");
path.pathSegList.initialize(path.createSVGPathSegClosePath());
debug("List correctly initialised.");
shouldBe("path.getPathSegAtLength(0)", '0');
shouldThrow("path.insertItemBefore(null, 0)");
shouldThrow("path.replaceItem(null, 0)");
shouldThrow("path.appendItem(null)");
successfullyParsed = true;
</script>
<script src="../../fast/js/resources/js-test-post.js"></script>
</body>
</html>
WebCore/ChangeLog
View file @ 33ea1761
2009-12-03 Oliver Hunt <oliver@apple.com>
Reviewed by Maciej Stachowiak.
NULL ptr in SVGPathSegList::getPathSegAtLength()
https://bugs.webkit.org/show_bug.cgi?id=30313
Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
Add null checks to SVGList's content manipulation functions to prevent
null values from entering the list in the first place.
Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html
* svg/SVGList.h:
(WebCore::SVGList::initialize):
(WebCore::SVGList::insertItemBefore):
(WebCore::SVGList::replaceItem):
(WebCore::SVGList::appendItem):
* svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::getPathSegAtLength):
* svg/SVGPathElement.h:
* svg/SVGPathElement.idl:
* svg/SVGPathSegList.cpp:
(WebCore::SVGPathSegList::getPathSegAtLength):
(WebCore::SVGPathSegList::toPathData):
(WebCore::SVGPathSegList::createAnimated):
* svg/SVGPathSegList.h:
2009-12-02 Yusuke Sato <yusukes@chromium.org>
 
Reviewed by Eric Seidel.
WebCore/svg/SVGList.h
View file @ 33ea1761
......@@ -56,6 +56,10 @@ namespace WebCore {
Item initialize(Item newItem, ExceptionCode& ec)
{
if (!newItem) {
ec = TYPE_MISMATCH_ERR;
return TypeOperations::nullItem();
}
clear(ec);
return appendItem(newItem, ec);
}
......@@ -92,8 +96,13 @@ namespace WebCore {
return m_vector[index];
}
Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode& ec)
{
if (!newItem) {
ec = TYPE_MISMATCH_ERR;
return TypeOperations::nullItem();
}
if (index < m_vector.size()) {
m_vector.insert(index, newItem);
} else {
......@@ -108,6 +117,11 @@ namespace WebCore {
ec = INDEX_SIZE_ERR;
return TypeOperations::nullItem();
}
if (!newItem) {
ec = TYPE_MISMATCH_ERR;
return TypeOperations::nullItem();
}
m_vector[index] = newItem;
return newItem;
......@@ -125,8 +139,13 @@ namespace WebCore {
return item;
}
Item appendItem(Item newItem, ExceptionCode&)
Item appendItem(Item newItem, ExceptionCode& ec)
{
if (!newItem) {
ec = TYPE_MISMATCH_ERR;
return TypeOperations::nullItem();
}
m_vector.append(newItem);
return newItem;
}
......
WebCore/svg/SVGPathElement.cpp
View file @ 33ea1761
......@@ -69,9 +69,9 @@ FloatPoint SVGPathElement::getPointAtLength(float length)
return toPathData().pointAtLength(length, ok);
}
unsigned long SVGPathElement::getPathSegAtLength(float length)
unsigned long SVGPathElement::getPathSegAtLength(float length, ExceptionCode& ec)
{
return pathSegList()->getPathSegAtLength(length);
return pathSegList()->getPathSegAtLength(length, ec);
}
PassRefPtr<SVGPathSegClosePath> SVGPathElement::createSVGPathSegClosePath()
......
WebCore/svg/SVGPathElement.h
View file @ 33ea1761
......@@ -62,7 +62,7 @@ namespace WebCore {
virtual bool isValid() const { return SVGTests::isValid(); }
float getTotalLength();
FloatPoint getPointAtLength(float distance);
unsigned long getPathSegAtLength(float distance);
unsigned long getPathSegAtLength(float distance, ExceptionCode&);
static PassRefPtr<SVGPathSegClosePath> createSVGPathSegClosePath();
static PassRefPtr<SVGPathSegMovetoAbs> createSVGPathSegMovetoAbs(float x, float y);
......
WebCore/svg/SVGPathElement.idl
View file @ 33ea1761
......@@ -37,7 +37,8 @@ module svg {
float getTotalLength();
SVGPoint getPointAtLength(in float distance);
unsigned long getPathSegAtLength(in float distance);
unsigned long getPathSegAtLength(in float distance)
raises(DOMException, SVGException);
SVGPathSegClosePath createSVGPathSegClosePath();
......
WebCore/svg/SVGPathSegList.cpp
View file @ 33ea1761
......@@ -51,15 +51,16 @@ SVGPathSegList::~SVGPathSegList()
{
}
unsigned SVGPathSegList::getPathSegAtLength(double)
unsigned SVGPathSegList::getPathSegAtLength(double, ExceptionCode& ec)
{
// FIXME : to be useful this will need to support non-normalized SVGPathSegLists
ExceptionCode ec = 0;
int len = numberOfItems();
// FIXME: Eventually this will likely move to a "path applier"-like model, until then PathTraversalState is less useful as we could just use locals
PathTraversalState traversalState(PathTraversalState::TraversalSegmentAtLength);
for (int i = 0; i < len; ++i) {
SVGPathSeg* segment = getItem(i, ec).get();
if (ec)
return 0;
float segmentLength = 0;
switch (segment->pathSegType()) {
case SVGPathSeg::PATHSEG_MOVETO_ABS:
......@@ -104,10 +105,12 @@ Path SVGPathSegList::toPathData()
{
// FIXME : This should also support non-normalized PathSegLists
Path pathData;
ExceptionCode ec = 0;
int len = numberOfItems();
ExceptionCode ec = 0;
for (int i = 0; i < len; ++i) {
SVGPathSeg* segment = getItem(i, ec).get();
if (ec)
return Path();
switch (segment->pathSegType()) {
case SVGPathSeg::PATHSEG_MOVETO_ABS:
{
......@@ -182,10 +185,14 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
if (!itemCount || itemCount != toList->numberOfItems())
return 0;
RefPtr<SVGPathSegList> result = create(fromList->associatedAttributeName());
ExceptionCode ec;
ExceptionCode ec = 0;
for (unsigned n = 0; n < itemCount; ++n) {
SVGPathSeg* from = fromList->getItem(n, ec).get();
if (ec)
return 0;
SVGPathSeg* to = toList->getItem(n, ec).get();
if (ec)
return 0;
if (from->pathSegType() == SVGPathSeg::PATHSEG_UNKNOWN || from->pathSegType() != to->pathSegType())
return 0;
RefPtr<SVGPathSeg> segment = 0;
......@@ -251,6 +258,8 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
ASSERT_NOT_REACHED();
}
result->appendItem(segment, ec);
if (ec)
return 0;
}
return result.release();
}
......
WebCore/svg/SVGPathSegList.h
View file @ 33ea1761
......@@ -36,7 +36,7 @@ namespace WebCore {
static PassRefPtr<SVGPathSegList> create(const QualifiedName& attributeName) { return adoptRef(new SVGPathSegList(attributeName)); }
virtual ~SVGPathSegList();
unsigned getPathSegAtLength(double);
unsigned getPathSegAtLength(double, ExceptionCode&);
Path toPathData();
static PassRefPtr<SVGPathSegList> createAnimated(const SVGPathSegList* fromList, const SVGPathSegList* toList, float progress);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment