[Webkit-unassigned] [Bug 67820] Initialize ExceptionCode in Element::removeAttribute

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Sep 13 00:56:18 PDT 2011


https://bugs.webkit.org/show_bug.cgi?id=67820


Abhishek Arya <inferno at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Product|Security                    |WebKit
            Version|525.x (Nightly build)       |528+ (Nightly build)
          Component|Security                    |HTML DOM
         AssignedTo|webkit-security-unassigned@ |webkit-unassigned at lists.web
                   |lists.webkit.org            |kit.org
              Group|Security-Sensitive          |




--- Comment #13 from Abhishek Arya <inferno at chromium.org>  2011-09-13 00:56:17 PST ---
After debugging, i understand that my understanding was wrong here. I was confusing that this uninitialized dummy variable (with ec) was retrievable via javascript, but it is not. Only ec is retrievable, which will get set of zero if this uninitialized dummy == NOT_FOUND_ERR. ec=0 is a common case, so this is not useful value. Removing security tags and sorry for the noise.

void DatasetDOMStringMap::deleteItem(const String& name, ExceptionCode& ec)
{
    if (!isValidPropertyName(name)) {
        ec = SYNTAX_ERR;
        return;
    }

    ExceptionCode dummy;
    m_element->removeAttribute(convertPropertyNameToAttributeName(name), dummy);
}

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list