diff options
author | John Mark Bell <jmb@netsurf-browser.org> | 2010-08-30 13:39:49 +0000 |
---|---|---|
committer | John Mark Bell <jmb@netsurf-browser.org> | 2010-08-30 13:39:49 +0000 |
commit | 755b8ac75fcb62e18f61fa83fba695cc4fd0bed5 (patch) | |
tree | c0b072d5c7a5d70e3e1b9aa496b37a6c3f04b1ef /src/core/characterdata.c | |
parent | b657c277f517f4ab0a4da21e4f8c4cb6f8f53013 (diff) | |
download | libdom-755b8ac75fcb62e18f61fa83fba695cc4fd0bed5.tar.gz libdom-755b8ac75fcb62e18f61fa83fba695cc4fd0bed5.tar.bz2 |
Jump through hoops to conform to the spec: apparently, it requires unsigned values to be considered as signed
svn path=/trunk/dom/; revision=10725
Diffstat (limited to 'src/core/characterdata.c')
-rw-r--r-- | src/core/characterdata.c | 36 |
1 files changed, 28 insertions, 8 deletions
diff --git a/src/core/characterdata.c b/src/core/characterdata.c index 6bb542d..05d12ea 100644 --- a/src/core/characterdata.c +++ b/src/core/characterdata.c @@ -179,8 +179,9 @@ dom_exception _dom_characterdata_get_length(struct dom_characterdata *cdata, * \param count The number of characters to extract * \param data Pointer to location to receive substring * \return DOM_NO_ERR on success, - * DOM_INDEX_SIZE_ERR if ::offset is greater than the number of - * characters in ::cdata. + * DOM_INDEX_SIZE_ERR if ::offset is negative or greater than the + * number of characters in ::cdata or + * ::count is negative. * * The returned string will have its reference count increased. It is * the responsibility of the caller to unref the string once it has @@ -196,6 +197,10 @@ dom_exception _dom_characterdata_substring_data( struct dom_node_internal *c = (struct dom_node_internal *) cdata; uint32_t len, end; + if ((signed long) offset < 0 || (signed long) count < 0) { + return DOM_INDEX_SIZE_ERR; + } + if (c->value != NULL) { len = dom_string_length(c->value); } else { @@ -260,8 +265,9 @@ dom_exception _dom_characterdata_append_data(struct dom_characterdata *cdata, * \param offset The character offset to insert at * \param data The data to insert * \return DOM_NO_ERR on success, - * DOM_INDEX_SIZE_ERR if ::offset is greater than the - * number of characters in ::cdata, + * DOM_INDEX_SIZE_ERR if ::offset is negative or greater + * than the number of characters in + * ::cdata, * DOM_NO_MODIFICATION_ALLOWED_ERR if ::cdata is readonly. */ dom_exception _dom_characterdata_insert_data(struct dom_characterdata *cdata, @@ -276,6 +282,10 @@ dom_exception _dom_characterdata_insert_data(struct dom_characterdata *cdata, return DOM_NO_MODIFICATION_ALLOWED_ERR; } + if ((signed long) offset < 0) { + return DOM_INDEX_SIZE_ERR; + } + if (c->value != NULL) { len = dom_string_length(c->value); } else { @@ -316,8 +326,9 @@ dom_exception _dom_characterdata_insert_data(struct dom_characterdata *cdata, * \param offset The character offset to start deletion from * \param count The number of characters to delete * \return DOM_NO_ERR on success, - * DOM_INDEX_SIZE_ERR if ::offset is greater than the - * number of characters in ::cdata, + * DOM_INDEX_SIZE_ERR if ::offset is negative or greater + * than the number of characters in + * ::cdata or ::count is negative, * DOM_NO_MODIFICATION_ALLOWED_ERR if ::cdata is readonly. */ dom_exception _dom_characterdata_delete_data(struct dom_characterdata *cdata, @@ -332,6 +343,10 @@ dom_exception _dom_characterdata_delete_data(struct dom_characterdata *cdata, return DOM_NO_MODIFICATION_ALLOWED_ERR; } + if ((signed long) offset < 0 || (signed long) count < 0) { + return DOM_INDEX_SIZE_ERR; + } + if (c->value != NULL) { len = dom_string_length(c->value); } else { @@ -375,8 +390,9 @@ dom_exception _dom_characterdata_delete_data(struct dom_characterdata *cdata, * \param count The number of characters to replace * \param data The replacement data * \return DOM_NO_ERR on success, - * DOM_INDEX_SIZE_ERR if ::offset is greater than the - * number of characters in ::cdata, + * DOM_INDEX_SIZE_ERR if ::offset is negative or greater + * than the number of characters in + * ::cdata or ::count is negative, * DOM_NO_MODIFICATION_ALLOWED_ERR if ::cdata is readonly. */ dom_exception _dom_characterdata_replace_data(struct dom_characterdata *cdata, @@ -392,6 +408,10 @@ dom_exception _dom_characterdata_replace_data(struct dom_characterdata *cdata, return DOM_NO_MODIFICATION_ALLOWED_ERR; } + if ((signed long) offset < 0 || (signed long) count < 0) { + return DOM_INDEX_SIZE_ERR; + } + if (c->value != NULL) { len = dom_string_length(c->value); } else { |