282194 - Add null checks to methods that take SVG objects as arguments

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jonathan Watt [:jwatt]]

We should check that the argument passed to SetOrientToAuto isn't null. This
will happen if the JavaScript values null or undefined are passed in from a
script allowing malicious person's to crash us.

Comment 1

[Jonathan Watt [:jwatt]]

Attachment: patch

Comment 2

[Jonathan Watt [:jwatt]]

Changing subject. There are several other places in the SVG DOM code where we
need to do this, and we should do them all at once.

Comment 3

[Jonathan Watt [:jwatt]]

Attachment: patch all potential crashers

In some locations the spec says we should return SVG_WRONG_TYPE_ERR when the
SVG object passed into a function is of the "wrong type". The spec doesn't tell
us how to behave when that happens for the following functions, but I believe
this is an mistake, and we should return the same value. That's what I've done
in this patch. I've also added comments to unimplemented functions to remind
the future implementer to null check.

  SVGLocatable:getTransformToElement
    (in nsSVGGraphicElement.cpp and nsSVGSVGElement.cpp)
    http://w3.org/TR/SVG11/types.html#InterfaceSVGLocatable
  SVGMatrix:multiply
    http://w3.org/TR/SVG11/coords.html#InterfaceSVGMatrix
  SVGPoint:matrixTransform
    http://w3.org/TR/SVG11/coords.html#InterfaceSVGPoint
  SVGSVGElement:getIntersectionList
  SVGSVGElement:getEnclosureList
  SVGSVGElement:checkIntersection
  SVGSVGElement:checkEnclosure
  SVGSVGElement:createSVGTransformFromMatrix
    http://w3.org/TR/SVG11/struct.html#InterfaceSVGSVGElement
  SVGTransform:setMatrix
    http://w3.org/TR/SVG11/coords.html#InterfaceSVGTransform
  SVGTextContentElement:getCharNumAtPosition
    (in nsSVGTSpanElement.cpp and nsSVGTextElement.cpp)
    http://w3.org/TR/SVG11/text.html#InterfaceSVGTextContentElement
  SVGMarkerElement:setOrientToAngle
    http://w3.org/TR/SVG11/painting.html#InterfaceSVGMarkerElement

Comment 4

[tor]

Comment on attachment 174372 [details] [diff] [review]
patch all potential crashers

You should mail the SVG WG asking for an errata.

Comment 5

[Jonathan Watt [:jwatt]]

Checked in.
http://bonsai.mozilla.org/cvsquery.cgi?who=jwatt%25jwatt.org&date=explicit&mindate=2005-02-16+10%3A39&maxdate=2005-02-16+10%3A39