← Back to branch summary

~jconti/ubuntu/oneiric/webkit/fix_doc_path

« back to all changes in this revision

Viewing changes to JavaScriptCore/kjs/property_slot.cpp

  • Committer: Bazaar Package Importer
  • Author(s): Mike Hommey
  • Date: 2008-09-27 08:57:48 UTC
  • mfrom: (3.1.6 intrepid)
  • Revision ID: james.westby@ubuntu.com-20080927085748-yhzld00w0rekp961
Tags: 1.0.1-4
http://bugs.debian.org/499771
WebCore/dom/Document.*, WebCore/loader/DocLoader.*: Avoid DoS via
crafted CSS import statements. Fixes: CVE-2008-3632. Closes: #499771.

Show diffs side-by-side

added added

removed removed

Lines of Context:
JavaScriptCore/kjs/property_slot.cpp
1
1
// -*- c-basic-offset: 4 -*-
2
2
/*
3
 
 *  This file is part of the KDE libraries
4
 
 *  Copyright (C) 2005 Apple Computer, Inc.
 
3
 *  Copyright (C) 2005, 2008 Apple Inc. All rights reserved.
5
4
 *
6
5
 *  This library is free software; you can redistribute it and/or
7
6
 *  modify it under the terms of the GNU Library General Public
23
22
 
24
23
#include "config.h"
25
24
#include "property_slot.h"
 
25
 
 
26
#include "JSGlobalObject.h"
26
27
#include "object.h"
 
28
#include "RegisterFileStack.h"
27
29
 
28
30
namespace KJS {
29
31
 
30
 
JSValue *PropertySlot::undefinedGetter(ExecState*, JSObject*, const Identifier&, const PropertySlot&)
 
32
JSValue* PropertySlot::undefinedGetter(ExecState*, const Identifier&, const PropertySlot&)
31
33
{
32
34
    return jsUndefined();
33
35
}
34
36
 
35
 
JSValue *PropertySlot::functionGetter(ExecState* exec, JSObject* originalObject, const Identifier&, const PropertySlot& slot)
 
37
JSValue* PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
36
38
{
37
 
    return slot.m_data.getterFunc->call(exec, originalObject, List::empty());
 
39
    CallData data;
 
40
    CallType callType = slot.m_data.getterFunc->getCallData(data);
 
41
    if (callType == CallTypeNative)
 
42
        return slot.m_data.getterFunc->callAsFunction(exec, static_cast<JSObject*>(slot.slotBase()), exec->emptyList());
 
43
    ASSERT(callType == CallTypeJS);
 
44
    RegisterFileStack* stack = &exec->dynamicGlobalObject()->registerFileStack();
 
45
    stack->pushFunctionRegisterFile();
 
46
    JSValue* result = slot.m_data.getterFunc->callAsFunction(exec, static_cast<JSObject*>(slot.slotBase()), exec->emptyList());
 
47
    stack->popFunctionRegisterFile();
 
48
    return result;    
38
49
}
39
50
 
40
51
}