nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

servo: Merge #6064 - Fix overflow in CharacterData (from nox:characterdata-overflow); r=Ms2ger

Browse source 
Source-Repo: https://github.com/servo/servo
Source-Revision: 0f1f71b56f55c0cf4cb0d075916f34ebfc706783
This commit is contained in:
Anthony Ramine 2015-05-17 13:40:30 -05:00
parent 476a71a377
commit 1608837686
1 changed files with 18 additions and 16 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

34
servo/components/script/dom/characterdata.rs
View file

@ -21,7 +21,6 @@ use util::str::DOMString;
use std::borrow::ToOwned; use std::borrow::ToOwned;
use std::cell::Ref; use std::cell::Ref;
use std::cmp;
// https://dom.spec.whatwg.org/#characterdata // https://dom.spec.whatwg.org/#characterdata
#[dom_struct] #[dom_struct]
@ -68,47 +67,50 @@ impl<'a> CharacterDataMethods for JSRef<'a, CharacterData> {
data.chars().count() as u32 data.chars().count() as u32
} }
// https://dom.spec.whatwg.org/#dom-characterdata-substringdata // https://dom.spec.whatwg.org/#dom-characterdata-substringdataoffset-count
fn SubstringData(self, offset: u32, count: u32) -> Fallible<DOMString> { fn SubstringData(self, offset: u32, count: u32) -> Fallible<DOMString> {
let data = self.data.borrow(); let data = self.data.borrow();
// Step 1. // Step 1.
let len = data.chars().count(); let length = data.chars().count() as u32;
if offset as usize > len { if offset > length {
// Step 2. // Step 2.
return Err(IndexSize); return Err(IndexSize);
} }
// Step 3. // Steps 3-4.
let end = cmp::min((offset + count) as usize, len); let end = if length - offset < count { length } else { offset + count };
// Step 4. Ok(data.slice_chars(offset as usize, end as usize).to_owned())
Ok(data.slice_chars(offset as usize, end).to_owned())
} }
// https://dom.spec.whatwg.org/#dom-characterdata-appenddata // https://dom.spec.whatwg.org/#dom-characterdata-appenddatadata
fn AppendData(self, data: DOMString) { fn AppendData(self, data: DOMString) {
self.data.borrow_mut().push_str(&data); self.data.borrow_mut().push_str(&data);
} }
// https://dom.spec.whatwg.org/#dom-characterdata-insertdata // https://dom.spec.whatwg.org/#dom-characterdata-insertdataoffset-data
fn InsertData(self, offset: u32, arg: DOMString) -> ErrorResult { fn InsertData(self, offset: u32, arg: DOMString) -> ErrorResult {
self.ReplaceData(offset, 0, arg) self.ReplaceData(offset, 0, arg)
} }
// https://dom.spec.whatwg.org/#dom-characterdata-deletedata // https://dom.spec.whatwg.org/#dom-characterdata-deletedataoffset-count
fn DeleteData(self, offset: u32, count: u32) -> ErrorResult { fn DeleteData(self, offset: u32, count: u32) -> ErrorResult {
self.ReplaceData(offset, count, "".to_owned()) self.ReplaceData(offset, count, "".to_owned())
} }
// https://dom.spec.whatwg.org/#dom-characterdata-replacedata // https://dom.spec.whatwg.org/#dom-characterdata-replacedataoffset-count-data
fn ReplaceData(self, offset: u32, count: u32, arg: DOMString) -> ErrorResult { fn ReplaceData(self, offset: u32, count: u32, arg: DOMString) -> ErrorResult {
// Step 1.
let length = self.data.borrow().chars().count() as u32; let length = self.data.borrow().chars().count() as u32;
if offset > length { if offset > length {
// Step 2.
return Err(IndexSize); return Err(IndexSize);
} }
let count = if offset + count > length { // Step 3.
length - offset let count = match length - offset {
} else { diff if diff < count => diff,
count _ => count,
}; };
// Step 4: Mutation observers.
// Step 5.
let mut data = self.data.borrow().slice_chars(0, offset as usize).to_owned(); let mut data = self.data.borrow().slice_chars(0, offset as usize).to_owned();
data.push_str(&arg); data.push_str(&arg);
data.push_str(&self.data.borrow().slice_chars((offset + count) as usize, length as usize)); data.push_str(&self.data.borrow().slice_chars((offset + count) as usize, length as usize));