diff options
| author | Timothy Pearson <kb9vqf@pearsoncomputing.net> | 2011-08-13 12:21:22 -0500 |
|---|---|---|
| committer | Timothy Pearson <kb9vqf@pearsoncomputing.net> | 2011-08-13 12:21:22 -0500 |
| commit | f65bcb8326e06816d7dc49e58bda120182dbbcd6 (patch) | |
| tree | 4e7fef001fc523929450778d10c86b41e6e32eda /opensuse/tdelibs/kdelibs-3.5.10-cve-2009-2537-select-length.patch | |
| parent | 131df957b41b4683571b1e36e6fed9d614d32356 (diff) | |
| parent | fa41f32b69994ecd75b7359fa2df08ea5a3480ab (diff) | |
| download | tde-packaging-f65bcb8326e06816d7dc49e58bda120182dbbcd6.tar.gz tde-packaging-f65bcb8326e06816d7dc49e58bda120182dbbcd6.zip | |
Merge branch 'master' of http://scm.trinitydesktop.org/scm/git/tde-packaging
Diffstat (limited to 'opensuse/tdelibs/kdelibs-3.5.10-cve-2009-2537-select-length.patch')
| -rw-r--r-- | opensuse/tdelibs/kdelibs-3.5.10-cve-2009-2537-select-length.patch | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/opensuse/tdelibs/kdelibs-3.5.10-cve-2009-2537-select-length.patch b/opensuse/tdelibs/kdelibs-3.5.10-cve-2009-2537-select-length.patch new file mode 100644 index 000000000..5972b0a38 --- /dev/null +++ b/opensuse/tdelibs/kdelibs-3.5.10-cve-2009-2537-select-length.patch @@ -0,0 +1,30 @@ +diff -ur kdelibs-3.5.10/khtml/ecma/kjs_html.cpp kdelibs-3.5.10-cve-2009-2537-select-length/khtml/ecma/kjs_html.cpp +--- kdelibs-3.5.10/khtml/ecma/kjs_html.cpp 2008-02-13 10:41:09.000000000 +0100 ++++ kdelibs-3.5.10-cve-2009-2537-select-length/khtml/ecma/kjs_html.cpp 2009-07-26 04:54:52.000000000 +0200 +@@ -62,6 +62,9 @@ + + #include <kdebug.h> + ++// CVE-2009-2537 (vendors agreed on max 10000 elements) ++#define MAX_SELECT_LENGTH 10000 ++ + namespace KJS { + + KJS_DEFINE_PROTOTYPE_WITH_PROTOTYPE(HTMLDocumentProto, DOMDocumentProto) +@@ -2550,8 +2553,14 @@ + case SelectValue: { select.setValue(str); return; } + case SelectLength: { // read-only according to the NS spec, but webpages need it writeable + Object coll = Object::dynamicCast( getSelectHTMLCollection(exec, select.options(), select) ); +- if ( coll.isValid() ) +- coll.put(exec,"length",value); ++ ++ if ( coll.isValid() ) { ++ if (value.toInteger(exec) >= MAX_SELECT_LENGTH) { ++ Object err = Error::create(exec, RangeError); ++ exec->setException(err); ++ } else ++ coll.put(exec, "length", value); ++ } + return; + } + // read-only: form |