25001 2009-04-02 07:48:55 -0700 Crash when content type parameters have no value 2009-04-02 10:12:10 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) PC All RESOLVED FIXED http://www.tvmunchies.com/2009/03/csi-miami-cartoon-nsfw.html Gtk, Soup P2 Normal --- 1 gustavo webkit-unassigned plaes oldest_to_newest 116273 0 gustavo 2009-04-02 07:48:55 -0700 When the Content-Type header has parameters with no = sign, soup_message_headers_get_content_type () will return a hash table which contains NULL as the value for the relevant name. The problem here is that soup_header_g_string_append_param () doesn't expect NULL values, as it should, leading to a crash. 116274 1 29189 gustavo 2009-04-02 07:53:20 -0700 Created attachment 29189 Handle the case where a Content-Type header parameter has no value (i.e. no = character), to work-around a bug in libsoup. --- WebCore/ChangeLog | 13 +++++++++++++ .../platform/network/soup/ResourceHandleSoup.cpp | 5 +++++ 2 files changed, 18 insertions(+), 0 deletions(-) 116275 2 29189 gustavo 2009-04-02 07:54:04 -0700 Comment on attachment 29189 Handle the case where a Content-Type header parameter has no value As commented in the code, this has been reported to soup: http://bugzilla.gnome.org/show_bug.cgi?id=577728 116278 3 29189 ap 2009-04-02 08:15:28 -0700 Comment on attachment 29189 Handle the case where a Content-Type header parameter has no value r=me, because this just fixes a crash, but I really, really dislike removing const from "const char*" here. A quick web search suggests that soup_header_g_string_append_param takes const char* parameters, so there should be no reason to do make such unsafe conversions. 116283 4 gustavo 2009-04-02 08:43:01 -0700 Landed as r42168, after reworking the constness, and casting with ap on IRC. 116292 5 plaes 2009-04-02 09:43:31 -0700 Please don't close this one yet, as this workaround can be removed later when new version of libsoup is out by just updating required libsoup version. 116298 6 gustavo 2009-04-02 10:12:10 -0700 (In reply to comment #5) > Please don't close this one yet, as this workaround can be removed later when > new version of libsoup is out by just updating required libsoup version. > I added a comment to the code to that effect, so I don't see a need to keep the bug open. The whole content type sniffing code is a work-around to be removed when soup (or webcore) provide that to us, actually. 29189 2009-04-02 07:53:20 -0700 2009-04-02 08:15:28 -0700 Handle the case where a Content-Type header parameter has no value Handle-the-case-where-a-Content-Type-header-parameter-has-no-value.patch text/plain 1679 gustavo YTBhNGQ3YjY0Mzg0MzI0NmZhNzlkZjMyMjE4MjJmZTEwZGJiZDJhYgpkaWZmIC0tZ2l0IGEvV2Vi Q29yZS9DaGFuZ2VMb2cgYi9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA0ZjYwM2FjLi45ODQ5MmEw IDEwMDY0NAotLS0gYS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9XZWJDb3JlL0NoYW5nZUxvZwpA QCAtMSwzICsxLDE2IEBACisyMDA5LTA0LTAyICBHdXN0YXZvIE5vcm9uaGEgU2lsdmEgIDxndXN0 YXZvLm5vcm9uaGFAY29sbGFib3JhLmNvLnVrPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0yNTAwMQorICAgICAgICBDcmFzaCB3aGVuIGNvbnRlbnQgdHlwZSBwYXJhbWV0ZXJzIGhh dmUgbm8gdmFsdWUKKworICAgICAgICBIYW5kbGUgdGhlIGNhc2Ugd2hlcmUgYSBDb250ZW50LVR5 cGUgaGVhZGVyIHBhcmFtZXRlciBoYXMgbm8KKyAgICAgICAgdmFsdWUgKGkuZS4gbm8gPSBjaGFy YWN0ZXIpLCB0byB3b3JrLWFyb3VuZCBhIGJ1ZyBpbiBsaWJzb3VwLgorCisgICAgICAgICogcGxh dGZvcm0vbmV0d29yay9zb3VwL1Jlc291cmNlSGFuZGxlU291cC5jcHA6CisgICAgICAgIChXZWJD b3JlOjpmaWxsUmVzcG9uc2VGcm9tTWVzc2FnZSk6CisKIDIwMDktMDQtMDIgIFlhZWwgQWhhcm9u ICA8eWFlbC5haGFyb25Abm9raWEuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFNpbW9uIEhh dXNtYW5uLgpkaWZmIC0tZ2l0IGEvV2ViQ29yZS9wbGF0Zm9ybS9uZXR3b3JrL3NvdXAvUmVzb3Vy Y2VIYW5kbGVTb3VwLmNwcCBiL1dlYkNvcmUvcGxhdGZvcm0vbmV0d29yay9zb3VwL1Jlc291cmNl SGFuZGxlU291cC5jcHAKaW5kZXggN2ZjZWVhMC4uZjZiZDA0MiAxMDA2NDQKLS0tIGEvV2ViQ29y ZS9wbGF0Zm9ybS9uZXR3b3JrL3NvdXAvUmVzb3VyY2VIYW5kbGVTb3VwLmNwcAorKysgYi9XZWJD b3JlL3BsYXRmb3JtL25ldHdvcmsvc291cC9SZXNvdXJjZUhhbmRsZVNvdXAuY3BwCkBAIC0xNzgs NiArMTc4LDExIEBAIHN0YXRpYyB2b2lkIGZpbGxSZXNwb25zZUZyb21NZXNzYWdlKFNvdXBNZXNz YWdlKiBtc2csIFJlc291cmNlUmVzcG9uc2UqIHJlc3BvbnNlCiAKICAgICAgICAgZ19oYXNoX3Rh YmxlX2l0ZXJfaW5pdCgmaGFzaFRhYmxlSXRlciwgY29udGVudFR5cGVQYXJhbWV0ZXJzKTsKICAg ICAgICAgd2hpbGUgKGdfaGFzaF90YWJsZV9pdGVyX25leHQoJmhhc2hUYWJsZUl0ZXIsICZoYXNo S2V5LCAmaGFzaFZhbHVlKSkgeworICAgICAgICAgICAgLy8gV29yay1hcm91bmQgYnVnIGluIHNv dXAgd2hpY2ggY2F1c2VzIGEgY3Jhc2g7CisgICAgICAgICAgICAvLyBTZWUgaHR0cDovL2J1Z3pp bGxhLmdub21lLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTc3NzI4CisgICAgICAgICAgICBpZiAoIWhh c2hWYWx1ZSkKKyAgICAgICAgICAgICAgICBoYXNoVmFsdWUgPSBjb25zdF9jYXN0PGNoYXIqPigi Iik7CisKICAgICAgICAgICAgIGdfc3RyaW5nX2FwcGVuZChwYXJhbWV0ZXJzU3RyaW5nLCAiOyAi KTsKICAgICAgICAgICAgIHNvdXBfaGVhZGVyX2dfc3RyaW5nX2FwcGVuZF9wYXJhbShwYXJhbWV0 ZXJzU3RyaW5nLCBzdGF0aWNfY2FzdDxjaGFyKj4oaGFzaEtleSksIHN0YXRpY19jYXN0PGNoYXIq PihoYXNoVmFsdWUpKTsKICAgICAgICAgfQo=