By default, Bugzilla does not search the list of RESOLVED bugs.
You can force it to do so by putting the upper-case word ALL in front of your search query, e.g.: ALL tdelibs
We recommend searching for bugs this way, as you may discover that your bug has already been resolved and fixed in a later release.

[patch] tdelibs 3.5.13.2 : fix possible DOS in konqueror

tdelibs-3.5.13.2-cve-2009-2537-select-length.patch (text/plain), 1.47 KB, created by Francois Andriot on 2013-05-31 16:30:50 CDT

(hide)

Description: tdelibs 3.5.13.2 : fix possible DOS in konqueror

Filename:

MIME Type:

Creator: Francois Andriot

Created: 2013-05-31 16:30:50 CDT

Size: 1.47 KB

patch

obsolete

>--- ./khtml/ecma/kjs_html.cpp.ORI 2013-05-31 23:24:29.490993792 +0200 >+++ ./khtml/ecma/kjs_html.cpp 2013-05-31 23:25:41.189508821 +0200 >@@ -62,6 +62,9 @@ > > #include <kdebug.h> > >+// CVE-2009-2537 (vendors agreed on max 10000 elements) >+#define MAX_SELECT_LENGTH 10000 >+ > namespace KJS { > > KJS_DEFINE_PROTOTYPE_WITH_PROTOTYPE(HTMLDocumentProto, DOMDocumentProto) >@@ -2550,8 +2553,14 @@ > case SelectValue: { select.setValue(str); return; } > case SelectLength: { // read-only according to the NS spec, but webpages need it writeable > Object coll = Object::dynamicCast( getSelectHTMLCollection(exec, select.options(), select) ); >- if ( coll.isValid() ) >- coll.put(exec,"length",value); >+ if ( coll.isValid() ) { >+ if (value.toInteger(exec) >= MAX_SELECT_LENGTH) { >+ Object err = Error::create(exec, RangeError); >+ exec->setException(err); >+ } else { >+ coll.put(exec, "length", value); >+ } >+ } > return; > } > // read-only: form View Attachment As Diff View Attachment As Raw

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    [x]
  • | Forgot Password
    Login: [x]