LayoutTests:

        Reviewed by Alexey.
        
        Test for DOS using composed character.

        * fast/text/large-text-composed-char-dos-expected.txt: Added.
        * fast/text/large-text-composed-char-dos.html: Added.

WebCore:

        Reviewed by Alexey.

        Alexey spotted a DOS by using string of 64k unbreakable character in
        fix for http://bugs.webkit.org/show_bug.cgi?id=12833

        * dom/Text.cpp:
        (WebCore::Text::createWithLengthLimit):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@20146 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog

+2007-03-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Alexey.
+        
+        Test for DOS using composed character.
+
+        * fast/text/large-text-composed-char-dos-expected.txt: Added.
+        * fast/text/large-text-composed-char-dos.html: Added.
+
 2007-03-13  David Kilzer  <ddkilzer@kilzer.net>
         Reviewed by Tim H.

WebCore/ChangeLog

+2007-03-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Alexey.
+
+        Alexey spotted a DOS by using string of 64k unbreakable character in
+        fix for http://bugs.webkit.org/show_bug.cgi?id=12833
+
+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+
 2007-03-13  Lars Knoll <lars@trolltech.com>
         Fix the Qt build

WebCore/dom/Text.cpp

@@ -212,6 +212,10 @@ PassRefPtr<Text> Text::createWithLengthLimit(Document* doc, const String& text,
     if (end < text.length() && !isTextBreak(it, end))
         end = textBreakPreceding(it, end);
         
+    // maxChars of unbreakable characters could lead to infinite loop
+    if (end <= start)
+        end = text.length();
+    
     String nodeText = text.substring(start, end - start);
     charsLeft = text.length() - end;