From 035eaa78499be49457184886b6ec338b4030ac33 Mon Sep 17 00:00:00 2001 From: James Bursa Date: Wed, 9 Jun 2004 23:13:55 +0000 Subject: [project @ 2004-06-09 23:13:55 by bursa] Fix double-free of background image url. Add background parameter to html_fetch_object(). svn path=/import/netsurf/; revision=944 --- render/box.c | 46 ++++++++++++++++++++++++---------------------- render/html.c | 16 +++++++++------- render/html.h | 3 ++- 3 files changed, 35 insertions(+), 30 deletions(-) diff --git a/render/box.c b/render/box.c index eb0befdfd..32c5209eb 100644 --- a/render/box.c +++ b/render/box.c @@ -571,15 +571,17 @@ end: xmlFree(status.href); /* Now fetch any background image for this box */ - if (box && box->style && - box->style->background_image.type == CSS_BACKGROUND_IMAGE_URI) { - /* start fetch */ - html_fetch_object(content, box->style->background_image.uri, - box, - image_types, - content->available_width, - 1000); - } + if (box && box->style && box->style->background_image.type == + CSS_BACKGROUND_IMAGE_URI) { + char *url = strdup(box->style->background_image.uri); + if (!url) { + /** \todo handle this */ + return inline_container; + } + /* start fetch */ + html_fetch_object(content, url, box, image_types, + content->available_width, 1000, true); + } LOG(("node %p, node type %i END", n, n->type)); return inline_container; @@ -871,7 +873,7 @@ struct box_result box_image(xmlNode *n, struct box_status *status, /* start fetch */ html_fetch_object(status->content, url, box, image_types, - status->content->available_width, 1000); + status->content->available_width, 1000, false); return (struct box_result) {box, false, false}; } @@ -1240,16 +1242,16 @@ struct box_result box_input(xmlNode *n, struct box_status *status, return (struct box_result) {0, false, true}; } gadget->box = box; - gadget->type = GADGET_IMAGE; - if ((s = (char *) xmlGetProp(n, (const xmlChar*) "src"))) { - url = url_join(s, status->content->data.html.base_url); - if (url) - html_fetch_object(status->content, url, box, - image_types, - status->content->available_width, - 1000); - xmlFree(s); - } + gadget->type = GADGET_IMAGE; + if ((s = (char *) xmlGetProp(n, (const xmlChar*) "src"))) { + url = url_join(s, status->content->data.html.base_url); + if (url) + html_fetch_object(status->content, url, box, + image_types, + status->content->available_width, + 1000, false); + xmlFree(s); + } } else { /* the default type is "text" */ @@ -2370,7 +2372,7 @@ bool plugin_decode(struct content* content, char* url, struct box* box, * when we fetch it (if the type was not specified or is different to that * given in the attributes). */ - html_fetch_object(content, url, box, 0, 1000, 1000); + html_fetch_object(content, url, box, 0, 1000, 1000, false); return true; } @@ -2566,7 +2568,7 @@ struct box_result box_frameset(xmlNode *n, struct box_status *status, LOG(("frame, url '%s'", url)); html_fetch_object(status->content, url, object_box, 0, - object_width, object_height); + object_width, object_height, false); xmlFree(s); c = c->next; diff --git a/render/html.c b/render/html.c index 12f286579..f3d19a072 100644 --- a/render/html.c +++ b/render/html.c @@ -83,6 +83,7 @@ void html_create(struct content *c, const char *params[]) html->fonts = 0; html->object_count = 0; html->object = 0; + html->imagemaps = 0; html->string_pool = pool_create(8000); assert(html->string_pool); html->box_pool = pool_create(sizeof (struct box) * 100); @@ -519,15 +520,19 @@ void html_convert_css_callback(content_msg msg, struct content *css, * Start a fetch for an object required by a page. * * \param c content structure - * \param url URL of object to fetch + * \param url URL of object to fetch (not copied, must be on heap) * \param box box that will contain the object - * \param permitted_types array of types, terminated by CONTENT_UNKNOWN, + * \param permitted_types array of types, terminated by CONTENT_UNKNOWN, * or 0 if all types except OTHER and UNKNOWN acceptable + * \param available_width estimate of width of object + * \param available_height estimate of height of object + * \param background this is a background image */ void html_fetch_object(struct content *c, char *url, struct box *box, const content_type *permitted_types, - int available_width, int available_height) + int available_width, int available_height, + bool background) { unsigned int i = c->data.html.object_count; union content_msg_data data; @@ -538,10 +543,7 @@ void html_fetch_object(struct content *c, char *url, struct box *box, c->data.html.object[i].url = url; c->data.html.object[i].box = box; c->data.html.object[i].permitted_types = permitted_types; - if (box->style->background_image.type == CSS_BACKGROUND_IMAGE_URI) - c->data.html.object[i].background = true; - else - c->data.html.object[i].background = false; + c->data.html.object[i].background = background; /* start fetch */ c->data.html.object[i].content = fetchcache(url, c->url, diff --git a/render/html.h b/render/html.h index 860af9680..683c5dc73 100644 --- a/render/html.h +++ b/render/html.h @@ -91,7 +91,8 @@ void html_reformat(struct content *c, unsigned int width, unsigned int height); void html_destroy(struct content *c); void html_fetch_object(struct content *c, char *url, struct box *box, const content_type *permitted_types, - int available_width, int available_height); + int available_width, int available_height, + bool background); /* in riscos/htmlinstance.c */ void html_add_instance(struct content *c, struct browser_window *bw, -- cgit v1.2.3