|Summary:||Uninitialized variable in WebCore::CSSFunctionValue::parserValue|
|Product:||WebKit||Reporter:||James Hawkins <jhawkins>|
|Component:||CSS||Assignee:||David Levin <levin>|
|Version:||528+ (Nightly build)|
Description James Hawkins 2009-07-20 11:59:41 PDT
WebCore::CSSFunctionValue::parserValue creates a CSSParserValue for a function, but doesn't initialize isInt (which obviously should be false). I will attach a patch shortly.
Comment 1 James Hawkins 2009-07-20 12:02:40 PDT
Created attachment 33097 [details] Patch which initializes a variable
Comment 2 James Hawkins 2009-07-20 12:16:03 PDT
Created attachment 33099 [details] removed tabs from Changelog
Comment 3 Dave Hyatt 2009-07-20 13:53:49 PDT
Comment on attachment 33099 [details] removed tabs from Changelog Test case?
Comment 4 James Hawkins 2009-07-20 14:31:39 PDT
Currently the only code that checks isInt will short-circuit on a check for CSSPrimitiveValue::CSS_NUMBER or (unitFlags & FInteger). CSSParser.cpp 419: if (!b && (unitflags & FInteger) && value->isInt) CSSParserValues.cpp 64: else if (unit == CSSPrimitiveValue::CSS_NUMBER && isInt) With that being said, I don't think I can write a test case that will fail before the change and succeed with the patch applied. Regardless, code added in the future could depend on the value of isInt alone, which could be set to garbage if left uninitialized.
Comment 5 Dave Hyatt 2009-07-20 15:30:09 PDT
Comment on attachment 33099 [details] removed tabs from Changelog Ok, sounds fine.
Comment 6 David Levin 2009-07-21 11:23:48 PDT
Assigned to levin for landing