summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFrancois Andriot <francois.andriot@free.fr>2013-06-01 18:12:53 +0200
committerSlávek Banko <slavek.banko@axis.cz>2013-06-01 18:12:53 +0200
commit89cfde63b8a29b6513d65cfb0f16b2b210257063 (patch)
tree43b4b0e8f1095c7d1c0114c86ec601509f6d4601
parenta67a48107f8996a6c753fdd02d15e234dbd17ceb (diff)
downloadtdelibs-89cfde63b8a29b6513d65cfb0f16b2b210257063.tar.gz
tdelibs-89cfde63b8a29b6513d65cfb0f16b2b210257063.zip
Fix possible DOS in konqueror (CVE-2009-2537)
-rw-r--r--tdehtml/ecma/kjs_html.cpp13
1 files changed, 11 insertions, 2 deletions
diff --git a/tdehtml/ecma/kjs_html.cpp b/tdehtml/ecma/kjs_html.cpp
index abd059e75..83de94612 100644
--- a/tdehtml/ecma/kjs_html.cpp
+++ b/tdehtml/ecma/kjs_html.cpp
@@ -62,6 +62,9 @@
#include <kdebug.h>
+// CVE-2009-2537 (vendors agreed on max 10000 elements)
+#define MAX_SELECT_LENGTH 10000
+
namespace KJS {
KJS_DEFINE_PROTOTYPE_WITH_PROTOTYPE(HTMLDocumentProto, DOMDocumentProto)
@@ -2550,8 +2553,14 @@ void KJS::HTMLElement::putValueProperty(ExecState *exec, int token, const Value&
case SelectValue: { select.setValue(str); return; }
case SelectLength: { // read-only according to the NS spec, but webpages need it writeable
Object coll = Object::dynamicCast( getSelectHTMLCollection(exec, select.options(), select) );
- if ( coll.isValid() )
- coll.put(exec,"length",value);
+ if ( coll.isValid() ) {
+ if (value.toInteger(exec) >= MAX_SELECT_LENGTH) {
+ Object err = Error::create(exec, RangeError);
+ exec->setException(err);
+ } else {
+ coll.put(exec, "length", value);
+ }
+ }
return;
}
// read-only: form