Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(119)

Side by Side Diff: Source/core/loader/DocumentLoader.cpp

Issue 125403003: Fix crash on incorrectly formatted MHTML documents (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Created 6 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « Source/core/loader/DocumentLoader.h ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved. 2 * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
3 * Copyright (C) 2011 Google Inc. All rights reserved. 3 * Copyright (C) 2011 Google Inc. All rights reserved.
4 * 4 *
5 * Redistribution and use in source and binary forms, with or without 5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions 6 * modification, are permitted provided that the following conditions
7 * are met: 7 * are met:
8 * 8 *
9 * 1. Redistributions of source code must retain the above copyright 9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer. 10 * notice, this list of conditions and the following disclaimer.
(...skipping 268 matching lines...) Expand 10 before | Expand all | Expand 10 after
279 if (!responseEndTime) 279 if (!responseEndTime)
280 responseEndTime = m_timeOfLastDataReceived; 280 responseEndTime = m_timeOfLastDataReceived;
281 if (!responseEndTime) 281 if (!responseEndTime)
282 responseEndTime = monotonicallyIncreasingTime(); 282 responseEndTime = monotonicallyIncreasingTime();
283 timing()->setResponseEnd(responseEndTime); 283 timing()->setResponseEnd(responseEndTime);
284 284
285 commitIfReady(); 285 commitIfReady();
286 if (!frameLoader()) 286 if (!frameLoader())
287 return; 287 return;
288 288
289 if (isArchiveMIMEType(m_response.mimeType())) { 289 if (!isArchiveMIMEType(m_response.mimeType()) || !createArchive()) {
Nate Chapin 2014/01/06 23:04:11 Should we consider changing this function's name b
Inactive 2014/01/07 00:38:17 Done.
290 createArchive();
291 } else {
292 // If this is an empty document, it will not have actually been created yet. Commit dummy data so that 290 // If this is an empty document, it will not have actually been created yet. Commit dummy data so that
293 // DocumentWriter::begin() gets called and creates the Document. 291 // DocumentWriter::begin() gets called and creates the Document.
294 if (!m_writer) 292 if (!m_writer)
295 commitData(0, 0); 293 commitData(0, 0);
296 } 294 }
297 295
298 endWriting(m_writer.get()); 296 endWriting(m_writer.get());
299 297
300 if (!m_mainDocumentError.isNull()) 298 if (!m_mainDocumentError.isNull())
301 return; 299 return;
(...skipping 336 matching lines...) Expand 10 before | Expand all | Expand 10 after
638 if (doc->isDelayingLoadEvent() && !doc->loadEventFinished()) 636 if (doc->isDelayingLoadEvent() && !doc->loadEventFinished())
639 return true; 637 return true;
640 if (doc->processingLoadEvent()) 638 if (doc->processingLoadEvent())
641 return true; 639 return true;
642 if (doc->hasActiveParser()) 640 if (doc->hasActiveParser())
643 return true; 641 return true;
644 } 642 }
645 return frameLoader()->subframeIsLoading(); 643 return frameLoader()->subframeIsLoading();
646 } 644 }
647 645
648 void DocumentLoader::createArchive() 646 bool DocumentLoader::createArchive()
649 { 647 {
650 ASSERT(m_mainResource); 648 ASSERT(m_mainResource);
651 m_archive = MHTMLArchive::create(m_response.url(), m_mainResource->resourceB uffer()); 649 m_archive = MHTMLArchive::create(m_response.url(), m_mainResource->resourceB uffer());
652 RELEASE_ASSERT(m_archive); 650 // Invalid MHTML.
651 if (!m_archive || !m_archive->mainResource()) {
652 m_archive.clear();
653 return false;
654 }
653 655
654 addAllArchiveResources(m_archive.get()); 656 addAllArchiveResources(m_archive.get());
655 ArchiveResource* mainResource = m_archive->mainResource(); 657 ArchiveResource* mainResource = m_archive->mainResource();
656 658
657 // The origin is the MHTML file, we need to set the base URL to the document encoded in the MHTML so 659 // The origin is the MHTML file, we need to set the base URL to the document encoded in the MHTML so
658 // relative URLs are resolved properly. 660 // relative URLs are resolved properly.
659 ensureWriter(mainResource->mimeType(), m_archive->mainResource()->url()); 661 ensureWriter(mainResource->mimeType(), m_archive->mainResource()->url());
660 662
661 commitData(mainResource->data()->data(), mainResource->data()->size()); 663 commitData(mainResource->data()->data(), mainResource->data()->size());
664 return true;
662 } 665 }
663 666
664 void DocumentLoader::addAllArchiveResources(MHTMLArchive* archive) 667 void DocumentLoader::addAllArchiveResources(MHTMLArchive* archive)
665 { 668 {
666 ASSERT(archive); 669 ASSERT(archive);
667 if (!m_archiveResourceCollection) 670 if (!m_archiveResourceCollection)
668 m_archiveResourceCollection = adoptPtr(new ArchiveResourceCollection); 671 m_archiveResourceCollection = adoptPtr(new ArchiveResourceCollection);
669 m_archiveResourceCollection->addAllResources(archive); 672 m_archiveResourceCollection->addAllResources(archive);
670 } 673 }
671 674
(...skipping 216 matching lines...) Expand 10 before | Expand all | Expand 10 after
888 void DocumentLoader::replaceDocument(const String& source, Document* ownerDocume nt) 891 void DocumentLoader::replaceDocument(const String& source, Document* ownerDocume nt)
889 { 892 {
890 m_frame->loader().stopAllLoaders(); 893 m_frame->loader().stopAllLoaders();
891 m_writer = createWriterFor(m_frame, ownerDocument, m_frame->document()->url( ), mimeType(), m_writer ? m_writer->encoding() : emptyAtom, m_writer ? m_writer ->encodingWasChosenByUser() : false, true); 894 m_writer = createWriterFor(m_frame, ownerDocument, m_frame->document()->url( ), mimeType(), m_writer ? m_writer->encoding() : emptyAtom, m_writer ? m_writer ->encodingWasChosenByUser() : false, true);
892 if (!source.isNull()) 895 if (!source.isNull())
893 m_writer->appendReplacingData(source); 896 m_writer->appendReplacingData(source);
894 endWriting(m_writer.get()); 897 endWriting(m_writer.get());
895 } 898 }
896 899
897 } // namespace WebCore 900 } // namespace WebCore
OLDNEW
« no previous file with comments | « Source/core/loader/DocumentLoader.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698