corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 809956 - Deal with an odd number of ] characters before ]]> in a CDATA section in the HTML parser. r=smaug.

Browse Source
This commit is contained in:
Henri Sivonen
2012-11-12 15:42:23 +02:00
parent 1675f70695
commit 0075e1c889
4 changed files with 163 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
parser/html/nsHtml5Tokenizer.cpp
View File

@@ -1371,24 +1371,31 @@ nsHtml5Tokenizer::stateLoop(int32_t state, PRUnichar c, int32_t pos, PRUnichar*
cdatarsqb_end: ;
}
case NS_HTML5TOKENIZER_CDATA_RSQB_RSQB: {
if (++pos == endPos) {
NS_HTML5_BREAK(stateloop);
}
c = checkChar(buf, pos);
switch(c) {
case '>': {
cstart = pos + 1;
state = P::transition(mViewSource, NS_HTML5TOKENIZER_DATA, reconsume, pos);
NS_HTML5_CONTINUE(stateloop);
for (; ; ) {
if (++pos == endPos) {
NS_HTML5_BREAK(stateloop);
}
default: {
tokenHandler->characters(nsHtml5Tokenizer::RSQB_RSQB, 0, 2);
cstart = pos;
reconsume = true;
state = P::transition(mViewSource, NS_HTML5TOKENIZER_CDATA_SECTION, reconsume, pos);
NS_HTML5_CONTINUE(stateloop);
c = checkChar(buf, pos);
switch(c) {
case ']': {
tokenHandler->characters(nsHtml5Tokenizer::RSQB_RSQB, 0, 1);
continue;
}
case '>': {
cstart = pos + 1;
state = P::transition(mViewSource, NS_HTML5TOKENIZER_DATA, reconsume, pos);
NS_HTML5_CONTINUE(stateloop);
}
default: {
tokenHandler->characters(nsHtml5Tokenizer::RSQB_RSQB, 0, 2);
cstart = pos;
reconsume = true;
state = P::transition(mViewSource, NS_HTML5TOKENIZER_CDATA_SECTION, reconsume, pos);
NS_HTML5_CONTINUE(stateloop);
}
}
}
}
case NS_HTML5TOKENIZER_ATTRIBUTE_VALUE_SINGLE_QUOTED: {
for (; ; ) {