diff options
Diffstat (limited to 'src/3rdparty/webkit/WebCore/ChangeLog')
| -rw-r--r-- | src/3rdparty/webkit/WebCore/ChangeLog | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog index 072beee..fb31572 100644 --- a/src/3rdparty/webkit/WebCore/ChangeLog +++ b/src/3rdparty/webkit/WebCore/ChangeLog @@ -1,3 +1,31 @@ +2009-05-15 Adam Barth <abarth@webkit.org> + + Reviewed by Oliver Hunt. + + https://bugs.webkit.org/show_bug.cgi?id=25741 + + Append instead of throwing when insertItemBefore gets an out-of-bound + index. + + Test: svg/dom/svglist-insertItemBefore-appends.html + + * svg/SVGList.h: + (WebCore::SVGList::insertItemBefore): + +2009-03-19 Oliver Hunt <oliver@apple.com> + + Reviewed by Darin Adler. + + <rdar://problem/6702386> Incorrect bound check in SVGList::insertItemBefore + + SVGList::insertItemBefore would not perform a bounds check on the + index it was provided, potentially leading to a buffer overflow. + + Test: svg/dom/svglist-exception-on-out-bounds-error.html + + * svg/SVGList.h: + (WebCore::SVGList::insertItemBefore): + 2009-05-19 Kenneth Rohde Christiansen <kenneth.christiansen@openbossa.org> Reviewed by Simon Hausmann. |