Bug 8542 - large value= attributes in alphabetic list markers cause crash
Summary: large value= attributes in alphabetic list markers cause crash
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Blocker
Assignee: Eric Seidel (no email)
URL: http://www.security-protocols.com/sp-...
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2006-04-22 22:21 PDT by Eric Seidel (no email)
Modified: 2006-04-23 02:34 PDT (History)
0 users

See Also:

Attachments
The fix (5.14 KB, patch)
2006-04-23 00:27 PDT, Eric Seidel (no email) 		hyatt: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Eric Seidel (no email) 2006-04-22 22:21:40 PDT 
large value= attributes in alphabetic list markers cause crash

This was reported via:
http://www.security-protocols.com/sp-x26-advisory.php

This was due to our bogus handling of value= arguments in alphabetical lists.  I fixed our behavior to match WinIE, but not FireFox (since they differed).
Comment 1 Eric Seidel (no email) 2006-04-23 00:27:37 PDT 
Created attachment 7919 [details]
The fix
Comment 2 Dave Hyatt 2006-04-23 00:35:37 PDT 
Comment on attachment 7919 [details]
The fix

r=me, but let's get a test with a bunch of list items that cycles through the alphabet a few times.  We want to have one that records our behavior there I think.
Comment 3 Eric Seidel (no email) 2006-04-23 01:23:46 PDT 
Actually, this patch isn't 100% correct.  it seems to get Z wrong.  I'll tweak it tomorrow, adding an additional layout test and land.
Comment 4 Eric Seidel (no email) 2006-04-23 02:34:27 PDT 
<rdar://problem/4523889> <li value=1234567890 type=A> causes crash