Do not normalize into NFC the values of form fields

Source/wtf/text/TextEncoding.cpp

 /*
  * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 54 matching lines @@
 }
 
 CString TextEncoding::encode(const String& string, UnencodableHandling handling) const
 {
     if (!m_name)
         return CString();
 
     if (string.isEmpty())
         return "";
 
+    OwnPtr<TextCodec> textCodec = newTextCodec(*this);
+    CString encodedString;
+    if (string.is8Bit())
+        encodedString = textCodec->encode(string.characters8(), string.length(), handling);
+    else
+        encodedString = textCodec->encode(string.characters16(), string.length(), handling);
+    return encodedString;
+}
+
+CString TextEncoding::normalizeAndEncode(const String& string, UnencodableHandling handling) const
+{
+    if (!m_name)
+        return CString();
+
+    if (string.isEmpty())
+        return "";
+
     // Text exclusively containing Latin-1 characters (U+0000..U+00FF) is left
     // unaffected by NFC. This is effectively the same as saying that all
     // Latin-1 text is already normalized to NFC.
     // Source: http://unicode.org/reports/tr15/
     if (string.is8Bit())
         return newTextCodec(*this)->encode(string.characters8(), string.length(), handling);
 
-    // FIXME: What's the right place to do normalization?
-    // It's a little strange to do it inside the encode function.
-    // Perhaps normalization should be an explicit step done before calling encode.
-
     const UChar* source = string.characters16();
     size_t length = string.length();
 
-    Vector<UChar> normalizedCharacters;
-
     UErrorCode err = U_ZERO_ERROR;
     if (unorm_quickCheck(source, length, UNORM_NFC, &err) != UNORM_YES) {
         // First try using the length of the original string, since normalization to NFC rarely increases length.
+        Vector<UChar> normalizedCharacters;

[abarth-chromium, 2013/07/24 18:20:09]

Moving this declaration inside the if statement causes a memory safety problem. 
Notice on line 115 that we store a pointer to this vector's data in |source|,
but after this change |normalizedCharacters| goes out of scope and the memory is
freed.  That means that |source| can point to garbage memory on line 118.

         normalizedCharacters.grow(length);
         int32_t normalizedLength = unorm_normalize(source, length, UNORM_NFC, 0, normalizedCharacters.data(), length, &err);
         if (err == U_BUFFER_OVERFLOW_ERROR) {
             err = U_ZERO_ERROR;
             normalizedCharacters.resize(normalizedLength);
             normalizedLength = unorm_normalize(source, length, UNORM_NFC, 0, normalizedCharacters.data(), normalizedLength, &err);
         }
         ASSERT(U_SUCCESS(err));
 
         source = normalizedCharacters.data();
@@ skipping 123 matching lines @@
     return globalUTF8Encoding;
 }
 
 const TextEncoding& WindowsLatin1Encoding()
 {
     static TextEncoding globalWindowsLatin1Encoding("WinLatin1");
     return globalWindowsLatin1Encoding;
 }
 
 } // namespace WTF