diff options
Diffstat (limited to 'gnu/packages/patches/icecat-CVE-2016-1961.patch')
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2016-1961.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2016-1961.patch b/gnu/packages/patches/icecat-CVE-2016-1961.patch new file mode 100644 index 0000000000..10162be24b --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-1961.patch @@ -0,0 +1,33 @@ +Copied from upstream: +https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/e93aeb25e2a4 + +# HG changeset patch +# User Andrew McCreight <continuation@gmail.com> +# Date 1455891967 28800 +# Node ID e93aeb25e2a44df8d22f5a065b4410620e2c8730 +# Parent 221de852fda32714a9e484774ceafafb450ea73c +Bug 1249377 - Hold a strong reference to |root| in nsHTMLDocument::SetBody. r=bz, a=sylvestre + +diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp +--- a/dom/html/nsHTMLDocument.cpp ++++ b/dom/html/nsHTMLDocument.cpp +@@ -1044,17 +1044,17 @@ nsHTMLDocument::SetBody(nsIDOMHTMLElemen + ErrorResult rv; + SetBody(static_cast<nsGenericHTMLElement*>(newBody.get()), rv); + return rv.ErrorCode(); + } + + void + nsHTMLDocument::SetBody(nsGenericHTMLElement* newBody, ErrorResult& rv) + { +- Element* root = GetRootElement(); ++ nsCOMPtr<Element> root = GetRootElement(); + + // The body element must be either a body tag or a frameset tag. And we must + // have a html root tag, otherwise GetBody will not return the newly set + // body. + if (!newBody || !(newBody->Tag() == nsGkAtoms::body || + newBody->Tag() == nsGkAtoms::frameset) || + !root || !root->IsHTML() || + root->Tag() != nsGkAtoms::html) { + |