Summary: | Crash in W3C-SVG-1.1/animate-elem-09-t.svg running layout tests under guard malloc | ||
---|---|---|---|
Product: | WebKit | Reporter: | Mark Rowe (bdash) <mrowe> |
Component: | SVG | Assignee: | Nobody <webkit-unassigned> |
Status: | RESOLVED FIXED | ||
Severity: | Major | Keywords: | LayoutTestFailure |
Priority: | P1 | ||
Version: | 420+ | ||
Hardware: | Mac | ||
OS: | OS X 10.4 |
Description
Mark Rowe (bdash)
2007-01-29 05:25:17 PST
The problem here is: while (ptr < end && *ptr != ';') // careful not to ignore whitespace inside values ptr++; if (ptr == valueStart) break; // walk backwards from the ; to ignore any whitespace const UChar* valueEnd = ptr; while (valueStart < valueEnd && isWhitespace(*valueEnd)) valueEnd--; When the first loop hits the end of the string, ptr will equal end. This leads to *valueEnd attempting to access one element past the end of the buffer. |