Bug 25001 – Crash when content type parameters have no value

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Gustavo Noronha (kov)]

When the Content-Type header has parameters with no = sign, soup_message_headers_get_content_type () will return a hash table which contains NULL as the value for the relevant name. The problem here is that soup_header_g_string_append_param () doesn't expect NULL values, as it should, leading to a crash.

[Gustavo Noronha (kov)]

Created attachment 29189 [details]
Handle the case where a Content-Type header parameter has no value

(i.e. no = character), to work-around a bug in libsoup.
---
 WebCore/ChangeLog                                  |   13 +++++++++++++
 .../platform/network/soup/ResourceHandleSoup.cpp   |    5 +++++
 2 files changed, 18 insertions(+), 0 deletions(-)

[Gustavo Noronha (kov)]

Comment on attachment 29189 [details]
Handle the case where a Content-Type header parameter has no value

As commented in the code, this has been reported to soup: http://bugzilla.gnome.org/show_bug.cgi?id=577728

[Alexey Proskuryakov]

Comment on attachment 29189 [details]
Handle the case where a Content-Type header parameter has no value

r=me, because this just fixes a crash, but I really, really dislike removing const from "const char*" here. A quick web search suggests that soup_header_g_string_append_param takes const char* parameters, so there should be no reason to do make such unsafe conversions.

[Gustavo Noronha (kov)]

Landed as r42168, after reworking the constness, and casting with ap on IRC.

[Priit Laes (IRC: plaes)]

Please don't close this one yet, as this workaround can be removed later when new version of libsoup is out by just updating required libsoup version.

[Gustavo Noronha (kov)]

(In reply to comment #5)
> Please don't close this one yet, as this workaround can be removed later when
> new version of libsoup is out by just updating required libsoup version.
> 

I added a comment to the code to that effect, so I don't see a need to keep the bug open. The whole content type sniffing code is a work-around to be removed when soup (or webcore) provide that to us, actually.