<html>
<body>
<div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
<table bgcolor="#f9f3c9" width="100%" cellpadding="12" style="border: 1px #c9c399 solid; border-radius: 6px; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tr>
<td>
This is an automatically generated e-mail. To reply, visit:
<a href="https://git.reviewboard.kde.org/r/126480/">https://git.reviewboard.kde.org/r/126480/</a>
</td>
</tr>
</table>
<br />
<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="12" style="border: 1px #888a85 solid; border-radius: 6px; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tr>
<td>
<div>Review request for KDE Frameworks, David Faure, Martin Tobias Holmedahl Sandsmark, and Patrick Spendrin.</div>
<div>By Michael Pyne.</div>
<div style="margin-top: 1.5em;">
<b style="color: #575012; font-size: 10pt;">Repository: </b>
khtml
</div>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;"><p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">This is a compendium of proposed fixes to the outstanding "High Impact" issues Coverity has reported against KHTML, and which I in my unilateral and infinite wisdom have judged are actually valid (more opinions are welcome! It should be possible to register for Coverity access to KDE runs if you ask from your kde.org address).</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">Coverity issues issues include CID #s: 257995, 257996, 259759, 257994, 257927, 257928, 1019703, 1019704, 1340892, 1340908</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">Fix-specific notes:</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">A few fixes for leaked auxiliary structs used to calculate a return value simply used a QScopedPointer, unless a mere "delete foo" was all that was required.</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">CID 259759, tiled pixmap cache misusage: QCache can in theory delete an object you insert as soon as you insert it, so we must guard against that possibility. If re-entrancy or concurrent use of the cache were possible then we would also need to guard against objects obtained from the cache being deleted, but I don't think that's possible so I didn't add sanity checking for that.</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">CID 257994, leaked font face during CSS parsing: I'm not completely sure this is possible but if it is, malicious web sites could induce possibly-large memory leaks. The leak would occur if a font with an empty/invalid name leaked into this routine (I think it would be even more restrictive than that, the leak would only be possible if no other font family were valid).</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">CID 257928, leak (mis-parse?) during CSS background property parsing: In essence we manually parse a list of value pairs, which are read into currValue{,2} and then migrated from currValue{,2} into value{,2} (a single value) and values{,2} (a list) in turn. The end of the procedure assumes that value{,2} are either both single values or both value lists, but the code path might result in a value list for the first with only a single value for the second. That single value for the second part of the pair would then be leaked (since the values2 list is empty at this point).</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">CID 1019703, 1019704, DTD Tag IDs: Potentially serious? At some point we added a tag type for "COMMENT" (which I would think the parser would eliminate from the AST, but maybe that is no longer the case?). However we didn't expand out some auxiliary data vectors we use for the tags, which Coverity flagged as a potential invalid memory access.</p></pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;"><p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">Everything compiles, clicking around in Konq on various websites and opening local XML files seems to work fine. I can't get CMake to build the autotests however (though there aren't very many anyways).</p></pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">
<li>src/css/css_webfont.cpp <span style="color: grey">(6754a30)</span></li>
<li>src/css/cssparser.cpp <span style="color: grey">(112c867)</span></li>
<li>src/ecma/kjs_html.cpp <span style="color: grey">(cc3c08a)</span></li>
<li>src/editing/htmlediting_impl.cpp <span style="color: grey">(d56c4a8)</span></li>
<li>src/html/dtd.cpp <span style="color: grey">(71cad5c)</span></li>
<li>src/rendering/render_object.cpp <span style="color: grey">(06dba1a)</span></li>
<li>src/xml/dom_docimpl.cpp <span style="color: grey">(4f0be5c)</span></li>
</ul>
<p><a href="https://git.reviewboard.kde.org/r/126480/diff/" style="margin-left: 3em;">View Diff</a></p>
</td>
</tr>
</table>
</div>
</body>
</html>