[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.21-584-g1e41756

[japhet at chromium.org]

The following commit has been merged in the webkit-1.1 branch:
commit 512db98c42adbbb3a45abb7e8657518f8cd31beb
Author: japhet at chromium.org <japhet at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Feb 8 22:43:07 2010 +0000

    2010-02-08  Nate Chapin  <japhet at chromium.org>
    
            Reviewed by Darin Fisher.
    
            Check that the index passed into BackForwardListClientImpl::itemAtIndex()
            is valid, and return null if it isn't.
    
            https://bugs.webkit.org/show_bug.cgi?id=34722
    
            * src/BackForwardListClientImpl.cpp:
            (WebKit::BackForwardListClientImpl::itemAtIndex):
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@54511 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebKit/chromium/ChangeLog b/WebKit/chromium/ChangeLog
index 9f43b8f..43f95c7 100644
--- a/WebKit/chromium/ChangeLog
+++ b/WebKit/chromium/ChangeLog
@@ -1,3 +1,15 @@
+2010-02-08  Nate Chapin  <japhet at chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Check that the index passed into BackForwardListClientImpl::itemAtIndex()
+        is valid, and return null if it isn't.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34722
+
+        * src/BackForwardListClientImpl.cpp:
+        (WebKit::BackForwardListClientImpl::itemAtIndex):
+
 2010-02-05  Dumitru Daniliuc  <dumi at chromium.org>
 
         Reviewed by Jeremy Orlow.
diff --git a/WebKit/chromium/src/BackForwardListClientImpl.cpp b/WebKit/chromium/src/BackForwardListClientImpl.cpp
index 8feae32..f5b04ab 100644
--- a/WebKit/chromium/src/BackForwardListClientImpl.cpp
+++ b/WebKit/chromium/src/BackForwardListClientImpl.cpp
@@ -90,7 +90,7 @@ HistoryItem* BackForwardListClientImpl::currentItem()
 
 HistoryItem* BackForwardListClientImpl::itemAtIndex(int index)
 {
-    if (!m_webView->client())
+    if (!m_webView->client() || index > forwardListCount() || -index > backListCount())
         return 0;
 
     // Since we don't keep the entire back/forward list, we have no way to

-- 
WebKit Debian packaging