File bnc512559-2009-1709.diff of Package kdegraphics3

--- ksvg/core/DocumentFactory.cpp.CVE-2009-1709	2005-10-10 16:56:46.000000000 +0200
+++ ksvg/core/DocumentFactory.cpp	2009-06-21 21:34:43.000000000 +0200
@@ -38,7 +38,7 @@
 		Private() { m_docs.setAutoDelete(true); }
 		~Private() { m_docs.clear(); }
 	
-		void setup(bool bFit) { m_docs.append(new SVGDocumentImpl(!bFit /* animations */, bFit)); }
+		void setup(bool bFit) { m_docs.append(new SVGDocumentImpl(false /* animations */, bFit)); }
 		SVGDocumentImpl *doc() const { return m_docs.current(); }
 
 	private:
--- ksvg/impl/SVGAnimationElementImpl.cc.CVE-2009-1709	2005-11-08 23:25:43.000000000 +0100
+++ ksvg/impl/SVGAnimationElementImpl.cc	2009-06-21 21:38:54.000000000 +0200
@@ -43,7 +43,6 @@
 	KSVG_EMPTY_FLAGS
 
 	m_connected = false;
-	m_targetElement = 0;
 
 	m_values = new SVGStringListImpl();
 	m_keyTimes= new SVGStringListImpl();
@@ -56,22 +55,18 @@
 
 SVGAnimationElementImpl::~SVGAnimationElementImpl()
 {
-	if(m_targetElement)
-		m_targetElement->deref();
 }
 
 SVGElementImpl *SVGAnimationElementImpl::targetElement() const
 {
-	if(!m_targetElement)
+	if (ownerDoc())
 	{
-		SVGAnimationElementImpl *modify = const_cast<SVGAnimationElementImpl *>(this);
-		if(!m_href.isEmpty())
-			modify->setTargetElement(ownerDoc()->getElementByIdRecursive(ownerSVGElement(), SVGURIReferenceImpl::getTarget(m_href)));
-		else if(!parentNode().isNull())
-			modify->setTargetElement(ownerDoc()->getElementFromHandle(parentNode().handle()));			
+		if (!m_href.isEmpty())
+			return ownerDoc()->getElementByIdRecursive(ownerSVGElement(), SVGURIReferenceImpl::getTarget(m_href));
+		else if (!parentNode().isNull())
+			return ownerDoc()->getElementFromHandle(parentNode().handle());
 	}
-
-	return m_targetElement;
+	return 0;
 }
 
 double SVGAnimationElementImpl::parseClockValue(const QString &data) const
@@ -215,7 +210,6 @@
 	switch(token)
 	{
 		case TargetElement:
-			return m_targetElement->cache(exec);
 		default:
 			kdWarning() << "Unhandled token in " << k_funcinfo << " : " << token << endl;
 			return Undefined();
@@ -384,7 +378,6 @@
 Value SVGAnimationElementImplProtoFunc::call(ExecState *exec, Object &thisObj, const List &)
 {
 	KSVG_CHECK_THIS(SVGAnimationElementImpl)
-
 	switch(id)
 	{
 		case SVGAnimationElementImpl::GetStartTime:
@@ -420,11 +413,6 @@
 
 void SVGAnimationElementImpl::setTargetElement(SVGElementImpl *target)
 {
-	if(m_targetElement)
-		m_targetElement->deref();
-
-	m_targetElement = target;
-	m_targetElement->ref();
 }
 
 void SVGAnimationElementImpl::applyAttribute(const QString &name, const QString &value)
--- ksvg/impl/SVGAnimationElementImpl.h.CVE-2009-1709	2005-10-10 16:56:52.000000000 +0200
+++ ksvg/impl/SVGAnimationElementImpl.h	2009-06-21 21:34:43.000000000 +0200
@@ -108,7 +108,6 @@
 	ECalcMode m_calcMode : 2;
 	ERestart m_restart : 2;
 	EAttributeType m_attributeType : 2;
-	SVGElementImpl *m_targetElement;
 
 	QString m_href;
 	QString m_attributeName;