diff options
| author | Francois Andriot <francois.andriot@free.fr> | 2013-06-01 18:12:53 +0200 |
|---|---|---|
| committer | Slávek Banko <slavek.banko@axis.cz> | 2013-06-01 18:48:46 +0200 |
| commit | ca0faebe9a41013e8ba2e0891cfc49d29ffc64c6 (patch) | |
| tree | aeb3867518d1fa68e2642513e15a799e1426edad /khtml | |
| parent | 62f646f835cbf8d0fa9c12fb0a8f96c489b4e92b (diff) | |
| download | tdelibs-ca0faebe9a41013e8ba2e0891cfc49d29ffc64c6.tar.gz tdelibs-ca0faebe9a41013e8ba2e0891cfc49d29ffc64c6.zip | |
Fix possible DOS in konqueror (CVE-2009-2537)
(cherry picked from commit 89cfde63b8a29b6513d65cfb0f16b2b210257063)
Diffstat (limited to 'khtml')
| -rw-r--r-- | khtml/ecma/kjs_html.cpp | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/khtml/ecma/kjs_html.cpp b/khtml/ecma/kjs_html.cpp index 57762ffd3..535ea1fb2 100644 --- a/khtml/ecma/kjs_html.cpp +++ b/khtml/ecma/kjs_html.cpp @@ -62,6 +62,9 @@ #include <kdebug.h> +// CVE-2009-2537 (vendors agreed on max 10000 elements) +#define MAX_SELECT_LENGTH 10000 + namespace KJS { KJS_DEFINE_PROTOTYPE_WITH_PROTOTYPE(HTMLDocumentProto, DOMDocumentProto) @@ -2550,8 +2553,14 @@ void KJS::HTMLElement::putValueProperty(ExecState *exec, int token, const Value& case SelectValue: { select.setValue(str); return; } case SelectLength: { // read-only according to the NS spec, but webpages need it writeable Object coll = Object::dynamicCast( getSelectHTMLCollection(exec, select.options(), select) ); - if ( coll.isValid() ) - coll.put(exec,"length",value); + if ( coll.isValid() ) { + if (value.toInteger(exec) >= MAX_SELECT_LENGTH) { + Object err = Error::create(exec, RangeError); + exec->setException(err); + } else { + coll.put(exec, "length", value); + } + } return; } // read-only: form |