Bug 62070 - XML memory parser handles NULL bytes wrong
Summary: XML memory parser handles NULL bytes wrong
Status: RESOLVED DUPLICATE of bug 61053
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-06-03 16:49 PDT by Vicki Pfau
Modified: 2019-02-06 09:03 PST (History)
2 users (show)

See Also:

Attachments
Patch (7.48 KB, patch)
2011-06-03 16:53 PDT, Vicki Pfau 		ap: review-
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Vicki Pfau 2011-06-03 16:49:09 PDT 
XML memory parser handles NULL bytes wrong
Comment 1 Vicki Pfau 2011-06-03 16:53:19 PDT 
Created attachment 95989 [details]
Patch
Comment 2 Alexey Proskuryakov 2011-06-03 17:30:27 PDT 
Comment on attachment 95989 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=95989&action=review

Please see bug 61053, which is related or even a duplicate. It it covers what is being fixed here, please dupe to the older bug.

If this fixes test cases from that bug, please consider adding them to the patch.

> LayoutTests/ChangeLog:8
> +        Added test cases for handling NULL bytes as inserted through the outerHTML property.

Do these actually pass in Firefox? It's always good to have tests that can be compared to other implementations.

> Source/WebCore/dom/XMLDocumentParserLibxml2.cpp:504
> +PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk, int len)

Please don't abbreviate. Maybe "chunkLength" or "chunkSize" would be good names?

> Source/WebCore/dom/XMLDocumentParserLibxml2.cpp:1457
> +        ASSERT(m_sawError || !chunkAsUtf8.data()[bytesProcessed]);

This will be an out of bounds read if bytesProcessed is -1.

Also, I don't quite understand the logic. If a null byte causes a failure, why doesn't m_sawError get set? I don't remember this code well enough to know why a JS exception will be raised without setting m_sawError. Could you please explain where the exception flies from?
Comment 3 Vicki Pfau 2011-06-07 10:06:55 PDT 

*** This bug has been marked as a duplicate of bug 61053 ***
Comment 4 Lucas Forschler 2019-02-06 09:03:12 PST 
Mass moving XML DOM bugs to the "DOM" Component.