1
0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-19 03:52:17 +00:00
freebsd-ports/www/firefox-esr/files/patch-ff-437142
Joe Marcus Clarke 87d7a27d12 Back-port some more patches to fix CVE-2009-0352.
Obtained from:	Mozilla Bugzilla
Reported by:	simon
2009-02-23 20:40:55 +00:00

117 lines
4.6 KiB
Plaintext

--- .pc/437142_backport_att350047.patch/layout/base/nsCSSFrameConstructor.cpp 2009-01-26 12:09:32.000000000 +0100
+++ layout/base/nsCSSFrameConstructor.cpp 2009-01-26 12:10:17.000000000 +0100
@@ -9902,17 +9902,19 @@ nsCSSFrameConstructor::ContentRemoved(ns
nsFrameManager *frameManager = mPresShell->FrameManager();
nsPresContext *presContext = mPresShell->GetPresContext();
nsresult rv = NS_OK;
// Find the child frame that maps the content
nsIFrame* childFrame;
mPresShell->GetPrimaryFrameFor(aChild, &childFrame);
- if (! childFrame) {
+ if (!childFrame || childFrame->GetContent() != aChild) {
+ // XXXbz the GetContent() != aChild check is needed due to bug 135040.
+ // Remove it once that's fixed.
frameManager->ClearUndisplayedContentIn(aChild, aContainer);
}
// When the last item is removed from a select,
// we need to add a pseudo frame so select gets sized as the best it can
// so here we see if it is a select and then we get the number of options
if (aContainer && childFrame) {
nsCOMPtr<nsIDOMHTMLSelectElement> selectElement = do_QueryInterface(aContainer);
@@ -9991,17 +9993,19 @@ nsCSSFrameConstructor::ContentRemoved(ns
// First update the containing blocks structure by removing the
// existing letter frames. This makes the subsequent logic
// simpler.
RemoveLetterFrames(presContext, mPresShell, frameManager,
containingBlock);
// Recover childFrame and parentFrame
mPresShell->GetPrimaryFrameFor(aChild, &childFrame);
- if (!childFrame) {
+ if (!childFrame || childFrame->GetContent() != aChild) {
+ // XXXbz the GetContent() != aChild check is needed due to bug 135040.
+ // Remove it once that's fixed.
frameManager->ClearUndisplayedContentIn(aChild, aContainer);
return NS_OK;
}
parentFrame = childFrame->GetParent();
#ifdef NOISY_FIRST_LETTER
printf(" ==> revised parentFrame=");
nsFrame::ListTag(stdout, parentFrame);
@@ -10502,16 +10506,24 @@ nsCSSFrameConstructor::ProcessRestyledFr
}
index = count;
while (0 <= --index) {
nsIFrame* frame;
nsIContent* content;
nsChangeHint hint;
aChangeList.ChangeAt(index, frame, content, hint);
+ if (frame && frame->GetContent() != content) {
+ // XXXbz this is due to image maps messing with the primary frame map.
+ // See bug 135040. Remove this block once that's fixed.
+ frame = nsnull;
+ if (!(hint & nsChangeHint_ReconstructFrame)) {
+ continue;
+ }
+ }
// skip any frame that has been destroyed due to a ripple effect
if (frame) {
nsresult res;
propTable->GetProperty(frame, nsLayoutAtoms::changeListProperty, &res);
if (NS_PROPTABLE_PROP_NOT_THERE == res)
@@ -10567,16 +10579,21 @@ nsCSSFrameConstructor::ProcessRestyledFr
return NS_OK;
}
void
nsCSSFrameConstructor::RestyleElement(nsIContent *aContent,
nsIFrame *aPrimaryFrame,
nsChangeHint aMinHint)
{
+ if (aPrimaryFrame && aPrimaryFrame->GetContent() != aContent) {
+ // XXXbz this is due to image maps messing with the primary frame mapping.
+ // See bug 135040. We can remove this block once that's fixed.
+ aPrimaryFrame = nsnull;
+ }
#ifdef ACCESSIBILITY
nsIAtom *prevRenderedFrameType = nsnull;
if (mPresShell->IsAccessibilityActive()) {
prevRenderedFrameType = GetRenderedFrameType(aPrimaryFrame);
}
#endif
if (aMinHint & nsChangeHint_ReconstructFrame) {
RecreateFramesForContent(aContent);
--- .pc/437142_backport_att350047.patch/layout/generic/nsImageMap.cpp 2009-01-26 12:09:32.000000000 +0100
+++ layout/generic/nsImageMap.cpp 2009-01-26 12:10:17.000000000 +0100
@@ -895,16 +895,22 @@ nsImageMap::AddArea(nsIContent* aArea)
return NS_ERROR_OUT_OF_MEMORY;
//Add focus listener to track area focus changes
nsCOMPtr<nsIDOMEventReceiver> rec(do_QueryInterface(aArea));
if (rec) {
rec->AddEventListenerByIID(this, NS_GET_IID(nsIDOMFocusListener));
}
+
+ // This is a nasty hack. It needs to go away: see bug 135040. Once this is
+ // removed, the code added to nsCSSFrameConstructor::RestyleElement,
+ // nsCSSFrameConstructor::ContentRemoved (both hacks there), and
+ // nsCSSFrameConstructor::ProcessRestyledFrames to work around this issue can
+ // be removed.
mPresShell->FrameManager()->SetPrimaryFrameFor(aArea, mImageFrame);
aArea->SetMayHaveFrame(PR_TRUE);
NS_ASSERTION(aArea->MayHaveFrame(), "SetMayHaveFrame failed?");
area->ParseCoords(coords);
mAreas.AppendElement(area);
return NS_OK;
}