From 48abb664b4b12f1933eafcc305b9e4369fc98aaa Mon Sep 17 00:00:00 2001 From: "bmlk%gmx.de" Date: Tue, 16 Nov 2004 15:46:55 +0000 Subject: [PATCH] large colspan protection as other browsers do, bug 141818 r/sr=bzbarsky git-svn-id: svn://10.0.0.236/trunk@165397 18797224-902f-48f8-a5cc-f745e15eee43 --- .../content/src/nsHTMLTableCellElement.cpp | 20 +++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp b/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp index 377f85ef645..927f63c2a12 100644 --- a/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp +++ b/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp @@ -263,7 +263,8 @@ static const nsHTMLValue::EnumTable kCellScopeTable[] = { { 0 } }; -#define MAX_COLROWSPAN 8190 // celldata.h can not handle more +#define MAX_ROWSPAN 8190 // celldata.h can not handle more +#define MAX_COLSPAN 1000 // limit as IE and opera do PRBool nsHTMLTableCellElement::ParseAttribute(nsIAtom* aAttribute, @@ -277,9 +278,20 @@ nsHTMLTableCellElement::ParseAttribute(nsIAtom* aAttribute, /* attributes that resolve to integers with a min of 0 */ return aResult.ParseIntWithBounds(aValue, 0); } - else if ((aAttribute == nsHTMLAtoms::colspan) || - (aAttribute == nsHTMLAtoms::rowspan)) { - PRBool res = aResult.ParseIntWithBounds(aValue, -1, MAX_COLROWSPAN); + if (aAttribute == nsHTMLAtoms::colspan) { + PRBool res = aResult.ParseIntWithBounds(aValue, -1); + if (res) { + PRInt32 val = aResult.GetIntegerValue(); + // reset large colspan values as IE and opera do + // quirks mode does not honor the special html 4 value of 0 + if (val > MAX_COLSPAN || val < 0 || (0 == val && InNavQuirksMode(GetOwnerDoc()))) { + aResult.SetTo(1, nsAttrValue::eInteger); + } + } + return res; + } + if (aAttribute == nsHTMLAtoms::rowspan) { + PRBool res = aResult.ParseIntWithBounds(aValue, -1, MAX_ROWSPAN); if (res) { PRInt32 val = aResult.GetIntegerValue(); // quirks mode does not honor the special html 4 value of 0