diff options
author | 2009-11-16 04:54:48 +0000 | |
---|---|---|
committer | 2009-11-16 04:54:48 +0000 | |
commit | dc7f3b0a290bce29f7104b2f65126621eadff497 (patch) | |
tree | 945918b8a23a589960422c2c80abc00596c04122 /x11-libs/qt-webkit | |
parent | Drop unused file (diff) | |
download | historical-dc7f3b0a290bce29f7104b2f65126621eadff497.tar.gz historical-dc7f3b0a290bce29f7104b2f65126621eadff497.tar.bz2 historical-dc7f3b0a290bce29f7104b2f65126621eadff497.zip |
Drop unused files
Package-Manager: portage--svn/cvs/Linux i686
Diffstat (limited to 'x11-libs/qt-webkit')
-rw-r--r-- | x11-libs/qt-webkit/ChangeLog | 7 | ||||
-rw-r--r-- | x11-libs/qt-webkit/files/0249-webkit-stale-frame-pointer.diff | 161 | ||||
-rw-r--r-- | x11-libs/qt-webkit/files/webkit-CVE-2009-1725.patch | 22 |
3 files changed, 6 insertions, 184 deletions
diff --git a/x11-libs/qt-webkit/ChangeLog b/x11-libs/qt-webkit/ChangeLog index c686e4583c06..146fe9433342 100644 --- a/x11-libs/qt-webkit/ChangeLog +++ b/x11-libs/qt-webkit/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for x11-libs/qt-webkit # Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-webkit/ChangeLog,v 1.66 2009/11/11 14:31:53 yngwin Exp $ +# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-webkit/ChangeLog,v 1.67 2009/11/16 04:54:48 abcd Exp $ + + 16 Nov 2009; Jonathan Callen <abcd@gentoo.org> + -files/0249-webkit-stale-frame-pointer.diff, + -files/webkit-CVE-2009-1725.patch: + Drop unused files 11 Nov 2009; Ben de Groot <yngwin@gentoo.org> -qt-webkit-4.4.2-r1.ebuild, -qt-webkit-4.4.2-r2.ebuild, -qt-webkit-4.5.1.ebuild, diff --git a/x11-libs/qt-webkit/files/0249-webkit-stale-frame-pointer.diff b/x11-libs/qt-webkit/files/0249-webkit-stale-frame-pointer.diff deleted file mode 100644 index d4173c457b97..000000000000 --- a/x11-libs/qt-webkit/files/0249-webkit-stale-frame-pointer.diff +++ /dev/null @@ -1,161 +0,0 @@ -qt-bugs@ issue : none yet -Trolltech task ID : none yet -bugs.kde.org number : none -applied: no -author: Apple - -this fixes CVE-2008-3632: - -Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, -and iPhone 1.0 through 2.0.2, allows remote attackers to execute arbitrary code -or cause a denial of service (application crash) via a web page with crafted -Cascading Style Sheets (CSS) import statements. - - ---- src/3rdparty/webkit/WebCore/dom/Document.cpp -+++ src/3rdparty/webkit/WebCore/dom/Document.cpp -@@ -291,9 +291,8 @@ - m_renderArena = 0; - - m_axObjectCache = 0; -- -- // FIXME: DocLoader probably no longer needs the frame argument -- m_docLoader = new DocLoader(frame, this); -+ -+ m_docLoader = new DocLoader(this); - - visuallyOrdered = false; - m_bParsing = false; -@@ -1169,15 +1168,23 @@ - if (render) - render->destroy(); - -- // FIXME: is this needed or desirable? -- m_frame = 0; -- -+ // This is required, as our Frame might delete itself as soon as it detaches -+ // us. However, this violates Node::detach() symantics, as it's never -+ // possible to re-attach. Eventually Document::detach() should be renamed -+ // or this call made explicit in each of the callers of Document::detach(). -+ clearFramePointer(); -+ - if (m_renderArena) { - delete m_renderArena; - m_renderArena = 0; - } - } - -+void Document::clearFramePointer() -+{ -+ m_frame = 0; -+} -+ - void Document::removeAllEventListenersFromAllNodes() - { - m_windowEventListeners.clear(); ---- src/3rdparty/webkit/WebCore/dom/Document.h -+++ src/3rdparty/webkit/WebCore/dom/Document.h -@@ -344,6 +344,8 @@ - virtual void attach(); - virtual void detach(); - -+ void clearFramePointer(); -+ - RenderArena* renderArena() { return m_renderArena; } - - AXObjectCache* axObjectCache() const; ---- src/3rdparty/webkit/WebCore/loader/DocLoader.cpp -+++ src/3rdparty/webkit/WebCore/loader/DocLoader.cpp -@@ -40,10 +40,9 @@ - - namespace WebCore { - --DocLoader::DocLoader(Frame *frame, Document* doc) -+DocLoader::DocLoader(Document* doc) - : m_cache(cache()) - , m_cachePolicy(CachePolicyVerify) -- , m_frame(frame) - , m_doc(doc) - , m_requestCount(0) - , m_autoLoadImages(true) -@@ -53,6 +52,11 @@ - m_cache->addDocLoader(this); - } - -+Frame* DocLoader::frame() const -+{ -+ return m_doc->frame(); -+} -+ - DocLoader::~DocLoader() - { - HashMap<String, CachedResource*>::iterator end = m_docResources.end(); -@@ -146,7 +150,7 @@ - } - } - -- if (m_frame && m_frame->loader()->isReloading()) -+ if (frame() && frame()->loader()->isReloading()) - setCachePolicy(CachePolicyReload); - - checkForReload(fullURL); -@@ -197,8 +201,8 @@ - void DocLoader::setLoadInProgress(bool load) - { - m_loadInProgress = load; -- if (!load && m_frame) -- m_frame->loader()->loadDone(); -+ if (!load && frame()) -+ frame()->loader()->loadDone(); - } - - void DocLoader::checkCacheObjectStatus(CachedResource* resource) -@@ -217,7 +221,7 @@ - } - - // Notify the caller that we "loaded". -- if (!m_frame || m_frame->loader()->haveToldBridgeAboutLoad(resource->url())) -+ if (!frame() || frame()->loader()->haveToldBridgeAboutLoad(resource->url())) - return; - - ResourceRequest request(resource->url()); -@@ -226,9 +230,9 @@ - - if (resource->sendResourceLoadCallbacks()) { - // FIXME: If the WebKit client changes or cancels the request, WebCore does not respect this and continues the load. -- m_frame->loader()->loadedResourceFromMemoryCache(request, response, data ? data->size() : 0); -+ frame()->loader()->loadedResourceFromMemoryCache(request, response, data ? data->size() : 0); - } -- m_frame->loader()->didTellBridgeAboutLoad(resource->url()); -+ frame()->loader()->didTellBridgeAboutLoad(resource->url()); - } - - void DocLoader::incrementRequestCount() ---- src/3rdparty/webkit/WebCore/loader/DocLoader.h -+++ src/3rdparty/webkit/WebCore/loader/DocLoader.h -@@ -49,7 +49,7 @@ - friend class HTMLImageLoader; - - public: -- DocLoader(Frame*, Document*); -+ DocLoader(Document*); - ~DocLoader(); - - CachedImage* requestImage(const String& url); -@@ -73,7 +73,7 @@ - CachePolicy cachePolicy() const { return m_cachePolicy; } - void setCachePolicy(CachePolicy); - -- Frame* frame() const { return m_frame; } -+ Frame* frame() const; // Can be NULL - Document* doc() const { return m_doc; } - - void removeCachedResource(CachedResource*) const; -@@ -100,7 +100,6 @@ - HashSet<String> m_reloadedURLs; - mutable HashMap<String, CachedResource*> m_docResources; - CachePolicy m_cachePolicy; -- Frame* m_frame; - Document *m_doc; - - int m_requestCount; diff --git a/x11-libs/qt-webkit/files/webkit-CVE-2009-1725.patch b/x11-libs/qt-webkit/files/webkit-CVE-2009-1725.patch deleted file mode 100644 index 80e45ad9770c..000000000000 --- a/x11-libs/qt-webkit/files/webkit-CVE-2009-1725.patch +++ /dev/null @@ -1,22 +0,0 @@ -Index: master/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp -=================================================================== ---- a/master/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp -+++ b/master/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp -@@ -865,5 +865,7 @@ - } else { - // FIXME: We should eventually colorize entities by sending them as a special token. -- checkBuffer(11); -+ // 12 bytes required: up to 10 bytes in m_cBuffer plus the -+ // leading '&' and trailing ';' -+ checkBuffer(12); - *dest++ = '&'; - for (unsigned i = 0; i < cBufferPos; i++) -@@ -876,5 +878,7 @@ - } - } else { -- checkBuffer(10); -+ // 11 bytes required: up to 10 bytes in m_cBuffer plus the -+ // leading '&' -+ checkBuffer(11); - // ignore the sequence, add it to the buffer as plaintext - *dest++ = '&'; |