mirrors/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity.git synced 2025-01-22 09:21:57 -05:00
Code Issues Projects Releases Packages Wiki Activity

LibWeb: Use substrings instead of pointers when parsing unicode ranges

Browse source 
Fixes a segfault when parsing a wildcard-only unicode range

(cherry picked from commit a4b38dda5611e87987c855de8a6e06aa0351bd1b)
This commit is contained in:
Gingeh 2024-11-05 21:57:25 +11:00 committed by Nico Weber
parent b6755e8189
commit be681da6a7
3 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/css/unicode-range-all-wildcard.txt Normal file
View file

@ -0,0 +1 @@
PASS (didn't crash)

11
Tests/LibWeb/Text/input/css/unicode-range-all-wildcard.html Normal file
View file

@ -0,0 +1,11 @@
<style>
@font-face {
unicode-range: U+??;
}
</style>
<script src="../include.js"></script>
<script>
test(() => {
println("PASS (didn't crash)");
});
</script>

3
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
View file

@ -2413,6 +2413,7 @@ Optional<Gfx::UnicodeRange> Parser::parse_unicode_range(StringView text)
// 3. Consume as many hex digits from text as possible.
// then consume as many U+003F QUESTION MARK (?) code points as possible.
auto start_position = lexer.tell();
auto hex_digits = lexer.consume_while(is_ascii_hex_digit);
auto question_marks = lexer.consume_while([](auto it) { return it == '?'; });
// If zero code points were consumed, or more than six code points were consumed,
@ -2422,7 +2423,7 @@ Optional<Gfx::UnicodeRange> Parser::parse_unicode_range(StringView text)
dbgln_if(CSS_PARSER_DEBUG, "CSSParser: <urange> start value had {} digits/?s, expected between 1 and 6.", consumed_code_points);
return {};
}
StringView start_value_code_points { hex_digits.characters_without_null_termination(), consumed_code_points };
StringView start_value_code_points = text.substring_view(start_position, consumed_code_points);
// If any U+003F QUESTION MARK (?) code points were consumed, then:
if (question_marks.length() > 0) {