[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.1-2-29-g5dbcb1c

[Michael Gilbert]

The following commit has been merged in the debian/unstable branch:
commit cdb7b6c8048147173e67116f48e492e171bc45d3
Author: Michael Gilbert <michael.s.gilbert at gmail.com>
Date:   Mon Jun 28 22:20:43 2010 -0400

    fix cve-2010-1774

diff --git a/WebCore/rendering/FixedTableLayout.cpp b/WebCore/rendering/FixedTableLayout.cpp
index 09af518..4d6b88c 100644
--- a/WebCore/rendering/FixedTableLayout.cpp
+++ b/WebCore/rendering/FixedTableLayout.cpp
@@ -166,8 +166,7 @@ int FixedTableLayout::calcWidthArray(int)
                 
                 int usedSpan = 0;
                 int i = 0;
-                while (usedSpan < span) {
-                    ASSERT(cCol + i < nEffCols);
+                while (usedSpan < span && cCol + i < nEffCols) {
                     int eSpan = m_table->spanOfEffCol(cCol + i);
                     // Only set if no col element has already set it.
                     if (m_width[cCol + i].isAuto() && w.type() != Auto) {
diff --git a/debian/changelog b/debian/changelog
index 85ed064..bad9707 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -27,6 +27,7 @@ webkit (1.2.1-3) UNRELEASED; urgency=low
   * Fix cve-2010-1771: possible code execution due to improper font handling.
   * Fix cve-2010-1772: geolocation disconnectframe timer issue.
   * Fix cve-2010-1773: integer overflow in alphabet conversion.
+  * Fix cve-2010-1774: integer overflow in table layout handling.
     element.
 
  -- Michael Gilbert <michael.s.gilbert at gmail.com>  Thu, 27 May 2010 20:36:41 -0400
diff --git a/debian/patches/cve-2010-1774.patch b/debian/patches/cve-2010-1774.patch
new file mode 100644
index 0000000..7a5a2f4
--- /dev/null
+++ b/debian/patches/cve-2010-1774.patch
@@ -0,0 +1,17 @@
+description: fix cve-2010-1774
+author: Michael Gilbert <michael.s.gilbert at gmail.com>
+origin: http://trac.webkit.org/changeset/59495
+Index: webkit-1.2.1/WebCore/rendering/FixedTableLayout.cpp
+===================================================================
+--- webkit-1.2.1.orig/WebCore/rendering/FixedTableLayout.cpp	2010-05-13 16:31:30.000000000 -0400
++++ webkit-1.2.1/WebCore/rendering/FixedTableLayout.cpp	2010-06-28 22:18:45.000000000 -0400
+@@ -166,8 +166,7 @@
+                 
+                 int usedSpan = 0;
+                 int i = 0;
+-                while (usedSpan < span) {
+-                    ASSERT(cCol + i < nEffCols);
++                while (usedSpan < span && cCol + i < nEffCols) {
+                     int eSpan = m_table->spanOfEffCol(cCol + i);
+                     // Only set if no col element has already set it.
+                     if (m_width[cCol + i].isAuto() && w.type() != Auto) {
diff --git a/debian/patches/series b/debian/patches/series
index bdceb85..2bc3c13 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -25,3 +25,4 @@ cve-2010-1770.patch
 cve-2010-1771.patch
 cve-2010-1772.patch
 cve-2010-1773.patch
+cve-2010-1774.patch

-- 
WebKit Debian packaging