[Pkg-chromium-commit] chromium-browser/chromium-browser.sid: 693 * Backported security patches from stable:

[Giuseppe Iuculano]

Branch name: chromium-browser/chromium-browser.sid
Branch location : bzr+ssh://bzr.debian.org/bzr/pkg-chromium/chromium-browser/chromium-browser.sid
Browse location: http://bzr.debian.org/loggerhead/pkg-chromium
Revision No: 693
Revision Id: iuculano at debian.org-20110114095010-7q5pc7mi0bmrtd4j
Committer: Giuseppe Iuculano <iuculano at debian.org>
Message : * Backported security patches from stable:
  - High Bad pointer handling in node iteration. Credit to Sergey Glazunov.


--------------------------------------------------------
  ** Added :
        - debian/patches/65764.patch

  ** Modified :
        - debian/changelog
        - debian/patches/series

-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog	2010-12-18 16:39:36 +0000
+++ b/debian/changelog	2011-01-14 09:50:10 +0000
@@ -1,3 +1,10 @@
+chromium-browser (6.0.472.63~r59945-5) UNRELEASED; urgency=high
+
+  * Backported security patches from stable:
+    - High Bad pointer handling in node iteration. Credit to Sergey Glazunov.
+
+ -- Giuseppe Iuculano <iuculano at debian.org>  Fri, 14 Jan 2011 10:48:43 +0100
+
 chromium-browser (6.0.472.63~r59945-4) unstable; urgency=high
 
   * Backported security patches from stable:

=== added file 'debian/patches/65764.patch'
--- a/debian/patches/65764.patch	1970-01-01 00:00:00 +0000
+++ b/debian/patches/65764.patch	2011-01-14 09:50:10 +0000
@@ -0,0 +1,45 @@
+--- a/src/third_party/WebKit/WebCore/dom/Document.cpp
++++ b/src/third_party/WebKit/WebCore/dom/Document.cpp
+@@ -3069,6 +3069,18 @@ void Document::detachNodeIterator(NodeIt
+     m_nodeIterators.remove(ni);
+ }
+ 
++void Document::moveNodeIteratorsToNewDocument(Node* node, Document* newDocument)
++{
++    HashSet<NodeIterator*> nodeIteratorsList = m_nodeIterators;
++    HashSet<NodeIterator*>::const_iterator nodeIteratorsEnd = nodeIteratorsList.end();
++    for (HashSet<NodeIterator*>::const_iterator it = nodeIteratorsList.begin(); it != nodeIteratorsEnd; ++it) {
++        if ((*it)->root() == node) {
++            detachNodeIterator(*it);
++            newDocument->attachNodeIterator(*it);
++        }
++    }
++}
++
+ void Document::nodeChildrenChanged(ContainerNode* container)
+ {
+     if (!disableRangeMutation(page())) {
+--- a/src/third_party/WebKit/WebCore/dom/Document.h
++++ b/src/third_party/WebKit/WebCore/dom/Document.h
+@@ -632,6 +632,7 @@ public:
+ 
+     void attachNodeIterator(NodeIterator*);
+     void detachNodeIterator(NodeIterator*);
++    void moveNodeIteratorsToNewDocument(Node*, Document*);
+ 
+     void attachRange(Range*);
+     void detachRange(Range*);
+--- a/src/third_party/WebKit/WebCore/dom/Node.cpp
++++ b/src/third_party/WebKit/WebCore/dom/Node.cpp
+@@ -439,8 +439,10 @@ void Node::setDocument(Document* documen
+         document->addNodeListCache();
+     }
+ 
+-    if (m_document)
++    if (m_document) {
++        m_document->moveNodeIteratorsToNewDocument(this, document);
+         m_document->selfOnlyDeref();
++    }
+ 
+     m_document = document;
+ 

=== modified file 'debian/patches/series'
--- a/debian/patches/series	2010-12-18 13:08:47 +0000
+++ b/debian/patches/series	2011-01-14 09:50:10 +0000
@@ -41,3 +41,4 @@
 63529.patch
 63866.patch
 64959.patch
+65764.patch