1 files changed, 15 insertions, 3 deletions
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 4237fca..abeb895 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -41,13 +41,15 @@
 
 // What type of connection should be used for the signals of the
 // QNetworkReply? This depends on if Qt has a bugfix for this or not.
-// It is fixed in Qt 4.6.1. See https://bugs.webkit.org/show_bug.cgi?id=32113
-#if QT_VERSION > QT_VERSION_CHECK(4, 6, 0)
+// It is fixed in Qt 4.6.3. See https://bugs.webkit.org/show_bug.cgi?id=32113
+// and https://bugs.webkit.org/show_bug.cgi?id=36755
+#if QT_VERSION > QT_VERSION_CHECK(4, 6, 2)
 #define SIGNAL_CONN Qt::DirectConnection
 #else
 #define SIGNAL_CONN Qt::QueuedConnection
 #endif
 
+static const int gMaxRecursionLimit = 10;
 
 namespace WebCore {
 
@@ -138,6 +140,7 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
     , m_shouldFinish(false)
     , m_shouldSendResponse(false)
     , m_shouldForwardData(false)
+    , m_redirectionTries(gMaxRecursionLimit)
 {
     const ResourceRequest &r = m_resourceHandle->request();
 
@@ -335,9 +338,18 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
+        QUrl newUrl = m_reply->url().resolved(redirection);
+
+        m_redirectionTries--;
+        if (m_redirectionTries == 0) { // 10 or more redirections to the same url is considered infinite recursion
+            ResourceError error(newUrl.host(), 400 /*bad request*/,
+                                newUrl.toString(),
+                                QCoreApplication::translate("QWebPage", "Redirection limit reached"));
+            client->didFail(m_resourceHandle, error);
+            return;
+        }
         m_redirected = true;
 
-        QUrl newUrl = m_reply->url().resolved(redirection);
         ResourceRequest newRequest = m_resourceHandle->request();
         newRequest.setURL(newUrl);