[patch] webkit-CVE-2009-1725.patch

webkit-CVE-2009-1725.patch (text/plain), 1002 bytes, created by Alex Legler (RETIRED) on 2009-08-17 16:26:56 UTC

Index: trunk/WebCore/html/HTMLTokenizer.cpp
===================================================================
--- a/trunk/WebCore/html/HTMLTokenizer.cpp
+++ b/trunk/WebCore/html/HTMLTokenizer.cpp
@@ -865,5 +865,7 @@
                 } else {
                     // FIXME: We should eventually colorize entities by sending them as a special token.
-                    checkBuffer(11);
+                    // 12 bytes required: up to 10 bytes in m_cBuffer plus the
+                    // leading '&' and trailing ';'
+                    checkBuffer(12);
                     *dest++ = '&';
                     for (unsigned i = 0; i < cBufferPos; i++)
@@ -876,5 +878,7 @@
                 }
             } else {
-                checkBuffer(10);
+                // 11 bytes required: up to 10 bytes in m_cBuffer plus the
+                // leading '&'
+                checkBuffer(11);
                 // ignore the sequence, add it to the buffer as plaintext
                 *dest++ = '&';