From f1fba1908f282e8213f6d8c45bddfa60a8abaf06 Mon Sep 17 00:00:00 2001
From: John Mark Bell <jmb@netsurf-browser.org>
Date: Fri, 6 Apr 2007 23:48:26 +0000
Subject: Fix embedded object + display: none; crash (1695751) (c.f r3236)

svn path=/trunk/netsurf/; revision=3239
---
 render/box_construct.c | 49 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 32 insertions(+), 17 deletions(-)

diff --git a/render/box_construct.c b/render/box_construct.c
index 7bc8b2152..2e59d1912 100644
--- a/render/box_construct.c
+++ b/render/box_construct.c
@@ -1314,6 +1314,9 @@ bool box_image(BOX_SPECIAL_PARAMS)
 	char *s, *url;
 	xmlChar *alt, *src;
 
+	if (box->style && box->style->display == CSS_DISPLAY_NONE)
+		return true;
+
 	/* handle alt text */
 	if ((alt = xmlGetProp(n, (const xmlChar *) "alt"))) {
 		s = squash_whitespace(alt);
@@ -1362,6 +1365,9 @@ bool box_object(BOX_SPECIAL_PARAMS)
 	xmlNode *c;
 	struct box *inline_container = 0;
 
+	if (box->style && box->style->display == CSS_DISPLAY_NONE)
+		return true;
+
 	if (!box_get_attribute(n, "usemap", content, &box->usemap))
 		return false;
 	if (box->usemap && box->usemap[0] == '#')
@@ -2121,25 +2127,31 @@ bool box_input(BOX_SPECIAL_PARAMS)
 			goto no_memory;
 		gadget->box = box;
 		gadget->type = GADGET_IMAGE;
-		if ((s = (char *) xmlGetProp(n, (const xmlChar*) "src"))) {
-			res = url_join(s, content->data.html.base_url, &url);
-			xmlFree(s);
-			/* if url is equivalent to the parent's url,
-			 * we've got infinite inclusion. stop it here.
-			 * also bail if url_join failed.
-			 */
-			if (res == URL_FUNC_OK &&
-					strcasecmp(url, content->data.
-					html.base_url) != 0) {
-				if (!html_fetch_object(content, url,
-						box, image_types,
-						content->available_width,
-						1000, false)) {
-					free(url);
-					goto no_memory;
+
+		if (box->style && box->style->display != CSS_DISPLAY_NONE) {
+			if ((s = (char *) xmlGetProp(n,
+					(const xmlChar*) "src"))) {
+				res = url_join(s,
+					content->data.html.base_url, &url);
+				xmlFree(s);
+				/* if url is equivalent to the parent's url,
+				 * we've got infinite inclusion. stop it here
+				 * also bail if url_join failed.
+				 */
+				if (res == URL_FUNC_OK &&
+						strcasecmp(url,
+						content->data.
+						html.base_url) != 0) {
+					if (!html_fetch_object(content, url,
+							box, image_types,
+							content->available_width,
+							1000, false)) {
+						free(url);
+						goto no_memory;
+					}
 				}
+				free(url);
 			}
-			free(url);
 		}
 
 	} else {
@@ -2581,6 +2593,9 @@ bool box_embed(BOX_SPECIAL_PARAMS)
 	xmlChar *src;
 	xmlAttr *a;
 
+	if (box->style && box->style->display == CSS_DISPLAY_NONE)
+		return true;
+
 	params = talloc(content, struct object_params);
 	if (!params)
 		return false;
-- 
cgit v1.2.3