[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.1-2-29-g5dbcb1c
Michael Gilbert
michael.s.gilbert at gmail.com
Tue Jun 29 04:11:32 UTC 2010
The following commit has been merged in the debian/unstable branch:
commit 57952a2f6e1d8529c6c9350c2fa7ee45763b065c
Author: Michael Gilbert <michael.s.gilbert at gmail.com>
Date: Mon Jun 28 21:47:10 2010 -0400
fix cve-2010-1664
diff --git a/WebCore/dom/make_names.pl b/WebCore/dom/make_names.pl
index 2d92a05..67cf340 100755
--- a/WebCore/dom/make_names.pl
+++ b/WebCore/dom/make_names.pl
@@ -287,8 +287,10 @@ sub printConstructorInterior
# Handle media elements.
if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
print F <<END
- if (!MediaPlayer::isAvailable())
+ Settings* settings = document->settings();
+ if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
return HTMLElement::create($constructorTagName, document);
+
END
;
}
@@ -638,7 +640,7 @@ printElementIncludes($F);
print F <<END
#include <wtf/HashMap.h>
-#if ENABLE(DASHBOARD_SUPPORT)
+#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(VIDEO)
#include "Document.h"
#include "Settings.h"
#endif
@@ -839,7 +841,8 @@ sub printWrapperFunctions
print F <<END
static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
{
- if (!MediaPlayer::isAvailable())
+ Settings* settings = element->document()->settings();
+ if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
}
@@ -857,14 +860,29 @@ END
;
}
} elsif ($wrapperFactoryType eq "V8") {
+ if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
+ print F <<END
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+{
+ Settings* settings = element->document()->settings();
+ if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
+ return toV8(static_cast<$parameters{namespace}Element*>(element));
+ return toV8(static_cast<${JSInterfaceName}*>(element));
+}
+
+END
+;
+ } else {
print F <<END
static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
{
return toV8(static_cast<${JSInterfaceName}*>(element));
}
+
END
;
+ }
}
if ($conditional) {
@@ -895,7 +913,16 @@ sub printWrapperFactoryCppFile
printElementIncludes($F);
- print F "\n#include <wtf/StdLibExtras.h>\n\n";
+ print F <<END
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(VIDEO)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
+END
+;
if ($wrapperFactoryType eq "JS") {
print F <<END
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index d60de12..18d310a 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -72,6 +72,7 @@ Settings::Settings(Page* page)
, m_privateBrowsingEnabled(false)
, m_caretBrowsingEnabled(false)
, m_areImagesEnabled(true)
+ , m_isMediaEnabled(true)
, m_arePluginsEnabled(false)
, m_localStorageEnabled(false)
, m_isJavaScriptEnabled(false)
@@ -263,6 +264,11 @@ void Settings::setImagesEnabled(bool areImagesEnabled)
m_areImagesEnabled = areImagesEnabled;
}
+void Settings::setMediaEnabled(bool isMediaEnabled)
+{
+ m_isMediaEnabled = isMediaEnabled;
+}
+
void Settings::setPluginsEnabled(bool arePluginsEnabled)
{
m_arePluginsEnabled = arePluginsEnabled;
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index 20cd847..6ca7d41 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -134,6 +134,9 @@ namespace WebCore {
void setImagesEnabled(bool);
bool areImagesEnabled() const { return m_areImagesEnabled; }
+ void setMediaEnabled(bool);
+ bool isMediaEnabled() const { return m_isMediaEnabled; }
+
void setPluginsEnabled(bool);
bool arePluginsEnabled() const { return m_arePluginsEnabled; }
@@ -326,6 +329,7 @@ namespace WebCore {
bool m_privateBrowsingEnabled : 1;
bool m_caretBrowsingEnabled : 1;
bool m_areImagesEnabled : 1;
+ bool m_isMediaEnabled : 1;
bool m_arePluginsEnabled : 1;
bool m_localStorageEnabled : 1;
bool m_isJavaScriptEnabled : 1;
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index 86862c3..e5e13b5 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -247,6 +247,7 @@ bool SVGImage::dataChanged(bool allDataReceived)
// The comment said that the Cache code does not know about CachedImages
// holding Frames and won't know to break the cycle. But
m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, 0, 0));
+ m_page->settings()->setMediaEnabled(false);
m_page->settings()->setJavaScriptEnabled(false);
m_page->settings()->setPluginsEnabled(false);
diff --git a/debian/changelog b/debian/changelog
index 9e3fa61..fdb0fcd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -14,6 +14,8 @@ webkit (1.2.1-3) UNRELEASED; urgency=low
* Fix cve-2010-1422: keyboard focus hijack.
* Fix cve-2010-1501: add check to prevent cross-site request forgery (this
may be duplicated as cve-2010-1767 in mitre's cve database).
+ * Fix cve-2010-1664: possible code execution due to improper html5 media
+ handling.
-- Michael Gilbert <michael.s.gilbert at gmail.com> Thu, 27 May 2010 20:36:41 -0400
diff --git a/debian/patches/cve-2010-1664.patch b/debian/patches/cve-2010-1664.patch
new file mode 100644
index 0000000..e5c3ce9
--- /dev/null
+++ b/debian/patches/cve-2010-1664.patch
@@ -0,0 +1,144 @@
+description: fix cve-2010-1664
+author: Michael Gilbert <michael.s.gilbert at gmail.com>
+origin: http://trac.webkit.org/changeset/57922
+Index: webkit-1.2.1/WebCore/dom/make_names.pl
+===================================================================
+--- webkit-1.2.1.orig/WebCore/dom/make_names.pl 2010-05-13 16:31:30.000000000 -0400
++++ webkit-1.2.1/WebCore/dom/make_names.pl 2010-06-28 21:46:05.000000000 -0400
+@@ -287,8 +287,10 @@
+ # Handle media elements.
+ if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
+ print F <<END
+- if (!MediaPlayer::isAvailable())
++ Settings* settings = document->settings();
++ if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
+ return HTMLElement::create($constructorTagName, document);
++
+ END
+ ;
+ }
+@@ -638,7 +640,7 @@
+ print F <<END
+ #include <wtf/HashMap.h>
+
+-#if ENABLE(DASHBOARD_SUPPORT)
++#if ENABLE(DASHBOARD_SUPPORT) || ENABLE(VIDEO)
+ #include "Document.h"
+ #include "Settings.h"
+ #endif
+@@ -839,7 +841,8 @@
+ print F <<END
+ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
+ {
+- if (!MediaPlayer::isAvailable())
++ Settings* settings = element->document()->settings();
++ if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
+ return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
+ return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
+ }
+@@ -857,14 +860,29 @@
+ ;
+ }
+ } elsif ($wrapperFactoryType eq "V8") {
++ if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
++ print F <<END
++static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
++{
++ Settings* settings = element->document()->settings();
++ if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
++ return toV8(static_cast<$parameters{namespace}Element*>(element));
++ return toV8(static_cast<${JSInterfaceName}*>(element));
++}
++
++END
++;
++ } else {
+ print F <<END
+ static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+ {
+ return toV8(static_cast<${JSInterfaceName}*>(element));
+ }
+
++
+ END
+ ;
++ }
+ }
+
+ if ($conditional) {
+@@ -895,7 +913,16 @@
+
+ printElementIncludes($F);
+
+- print F "\n#include <wtf/StdLibExtras.h>\n\n";
++ print F <<END
++#include <wtf/StdLibExtras.h>
++
++#if ENABLE(VIDEO)
++#include "Document.h"
++#include "Settings.h"
++#endif
++
++END
++;
+
+ if ($wrapperFactoryType eq "JS") {
+ print F <<END
+Index: webkit-1.2.1/WebCore/page/Settings.h
+===================================================================
+--- webkit-1.2.1.orig/WebCore/page/Settings.h 2010-06-28 21:36:35.000000000 -0400
++++ webkit-1.2.1/WebCore/page/Settings.h 2010-06-28 21:45:46.000000000 -0400
+@@ -134,6 +134,9 @@
+ void setImagesEnabled(bool);
+ bool areImagesEnabled() const { return m_areImagesEnabled; }
+
++ void setMediaEnabled(bool);
++ bool isMediaEnabled() const { return m_isMediaEnabled; }
++
+ void setPluginsEnabled(bool);
+ bool arePluginsEnabled() const { return m_arePluginsEnabled; }
+
+@@ -326,6 +329,7 @@
+ bool m_privateBrowsingEnabled : 1;
+ bool m_caretBrowsingEnabled : 1;
+ bool m_areImagesEnabled : 1;
++ bool m_isMediaEnabled : 1;
+ bool m_arePluginsEnabled : 1;
+ bool m_localStorageEnabled : 1;
+ bool m_isJavaScriptEnabled : 1;
+Index: webkit-1.2.1/WebCore/page/Settings.cpp
+===================================================================
+--- webkit-1.2.1.orig/WebCore/page/Settings.cpp 2010-06-28 21:36:35.000000000 -0400
++++ webkit-1.2.1/WebCore/page/Settings.cpp 2010-06-28 21:45:46.000000000 -0400
+@@ -72,6 +72,7 @@
+ , m_privateBrowsingEnabled(false)
+ , m_caretBrowsingEnabled(false)
+ , m_areImagesEnabled(true)
++ , m_isMediaEnabled(true)
+ , m_arePluginsEnabled(false)
+ , m_localStorageEnabled(false)
+ , m_isJavaScriptEnabled(false)
+@@ -263,6 +264,11 @@
+ m_areImagesEnabled = areImagesEnabled;
+ }
+
++void Settings::setMediaEnabled(bool isMediaEnabled)
++{
++ m_isMediaEnabled = isMediaEnabled;
++}
++
+ void Settings::setPluginsEnabled(bool arePluginsEnabled)
+ {
+ m_arePluginsEnabled = arePluginsEnabled;
+Index: webkit-1.2.1/WebCore/svg/graphics/SVGImage.cpp
+===================================================================
+--- webkit-1.2.1.orig/WebCore/svg/graphics/SVGImage.cpp 2010-05-13 16:31:30.000000000 -0400
++++ webkit-1.2.1/WebCore/svg/graphics/SVGImage.cpp 2010-06-28 21:45:46.000000000 -0400
+@@ -247,6 +247,7 @@
+ // The comment said that the Cache code does not know about CachedImages
+ // holding Frames and won't know to break the cycle. But
+ m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, 0, 0));
++ m_page->settings()->setMediaEnabled(false);
+ m_page->settings()->setJavaScriptEnabled(false);
+ m_page->settings()->setPluginsEnabled(false);
+
diff --git a/debian/patches/series b/debian/patches/series
index 325c2ed..e30cb0f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -15,3 +15,4 @@ cve-2010-1418-part3.patch
cve-2010-1422.patch
cve-2010-1421.patch
cve-2010-1501+1767.patch
+cve-2010-1664.patch
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list