Open
Bug 551031
Opened 16 years ago
Updated 3 years ago
Limit the length of internal transform arrays for SVG/SMIL
Categories
(Core :: SVG, defect)
Core
SVG
Tracking
()
NEW
People
(Reporter: dholbert, Unassigned)
Details
As discussed in bug 550593 comment 7 through bug 550593 comment 11, we'd like to make it harder for authors to DOS us by using up all our memory with large transform lists.
roc suggests that we cap the maximum number of transforms that we allow in our transform arrays. We'd need to check against this maximum number in at least these places:
- nsSVGTransformList::SetValueString (for setting the "transform" attr)
- nsSVGTransformSMILType::SandwichAdd (for appending a single <animateTransform> element's result to the animation sandwich)
|
||
Updated•3 years ago
|
Severity: normal → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•