Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-13 05:15:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 658845: Null-check URI passed to nsReferencedElement::Reset. r=roc

Browse Source
This commit is contained in:
Daniel Holbert 2011-05-22 16:13:57 -07:00
parent 52ff4fdee7
commit 6b37a32f2d
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
content/base/crashtests/658845-1.svg Normal file
View File

@ -0,0 +1,3 @@
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<use xlink:href="data:" />
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 120 B

1
content/base/crashtests/crashtests.list
View File

@ -90,3 +90,4 @@ load 637214-1.svg
load 637214-2.svg
load 642022-1.html
load 646184.html
load 658845-1.svg

4
content/base/src/nsReferencedElement.cpp
View File

@ -52,10 +52,12 @@ nsReferencedElement::Reset(nsIContent* aFromContent, nsIURI* aURI,
PRBool aWatch, PRBool aReferenceImage)
{
NS_ABORT_IF_FALSE(aFromContent, "Reset() expects non-null content pointer");
NS_ABORT_IF_FALSE(aURI, "Reset() expects non-null URI for referenced elem");
Unlink();
if (!aURI)
return;
nsCAutoString refPart;
aURI->GetRef(refPart);
// Unescape %-escapes in the reference. The result will be in the