guix/gnu/packages/patches/icecat-CVE-2016-2819.patch

  changeset:   312054:072992bf176d
  user:        Henri Sivonen <hsivonen@hsivonen.fi>
  Date:        Sun May 15 17:03:06 2016 +0300
  summary:     Bug 1270381. r=wchen. a=ritu

diff -r d30748143c21 -r 072992bf176d parser/html/javasrc/TreeBuilder.java
--- a/parser/html/javasrc/TreeBuilder.java	Mon May 09 18:05:32 2016 -0700
+++ b/parser/html/javasrc/TreeBuilder.java	Sun May 15 17:03:06 2016 +0300
@@ -39,6 +39,11 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import org.xml.sax.ErrorHandler;
+import org.xml.sax.Locator;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXParseException;
+
 import nu.validator.htmlparser.annotation.Auto;
 import nu.validator.htmlparser.annotation.Const;
 import nu.validator.htmlparser.annotation.IdType;
@@ -54,11 +59,6 @@
 import nu.validator.htmlparser.common.TokenHandler;
 import nu.validator.htmlparser.common.XmlViolationPolicy;
 
-import org.xml.sax.ErrorHandler;
-import org.xml.sax.Locator;
-import org.xml.sax.SAXException;
-import org.xml.sax.SAXParseException;
-
 public abstract class TreeBuilder<T> implements TokenHandler,
         TreeBuilderState<T> {
 
@@ -1924,7 +1924,6 @@
                                     break starttagloop;
                                 }
                                 generateImpliedEndTags();
-                                // XXX is the next if dead code?
                                 if (errorHandler != null && !isCurrent("table")) {
                                     errNoCheckUnclosedElementsOnStack();
                                 }
@@ -2183,11 +2182,11 @@
                                             pop();
                                         }
                                         break;
-                                    } else if (node.isSpecial()
+                                    } else if (eltPos == 0 || (node.isSpecial()
                                             && (node.ns != "http://www.w3.org/1999/xhtml"
-                                                || (node.name != "p"
-                                                    && node.name != "address"
-                                                    && node.name != "div"))) {
+                                                    || (node.name != "p"
+                                                            && node.name != "address"
+                                                            && node.name != "div")))) {
                                         break;
                                     }
                                     eltPos--;
@@ -3878,7 +3877,7 @@
                                         pop();
                                     }
                                     break endtagloop;
-                                } else if (node.isSpecial()) {
+                                } else if (eltPos == 0 || node.isSpecial()) {
                                     errStrayEndTag(name);
                                     break endtagloop;
                                 }
@@ -4745,6 +4744,7 @@
             int furthestBlockPos = formattingEltStackPos + 1;
             while (furthestBlockPos <= currentPtr) {
                 StackNode<T> node = stack[furthestBlockPos]; // weak ref
+                assert furthestBlockPos > 0: "How is formattingEltStackPos + 1 not > 0?";
                 if (node.isSpecial()) {
                     break;
                 }
diff -r d30748143c21 -r 072992bf176d parser/html/nsHtml5TreeBuilder.cpp
--- a/parser/html/nsHtml5TreeBuilder.cpp	Mon May 09 18:05:32 2016 -0700
+++ b/parser/html/nsHtml5TreeBuilder.cpp	Sun May 15 17:03:06 2016 +0300
@@ -1102,7 +1102,7 @@
                     pop();
                   }
                   break;
-                } else if (node->isSpecial() && (node->ns != kNameSpaceID_XHTML || (node->name != nsHtml5Atoms::p && node->name != nsHtml5Atoms::address && node->name != nsHtml5Atoms::div))) {
+                } else if (!eltPos || (node->isSpecial() && (node->ns != kNameSpaceID_XHTML || (node->name != nsHtml5Atoms::p && node->name != nsHtml5Atoms::address && node->name != nsHtml5Atoms::div)))) {
                   break;
                 }
                 eltPos--;
@@ -2749,7 +2749,7 @@
                   pop();
                 }
                 NS_HTML5_BREAK(endtagloop);
-              } else if (node->isSpecial()) {
+              } else if (!eltPos || node->isSpecial()) {
                 errStrayEndTag(name);
                 NS_HTML5_BREAK(endtagloop);
               }
@@ -3593,6 +3593,7 @@
     int32_t furthestBlockPos = formattingEltStackPos + 1;
     while (furthestBlockPos <= currentPtr) {
       nsHtml5StackNode* node = stack[furthestBlockPos];
+      MOZ_ASSERT(furthestBlockPos > 0, "How is formattingEltStackPos + 1 not > 0?");
       if (node->isSpecial()) {
         break;
       }