Title: [107369] trunk
- Revision
- 107369
- Author
- [email protected]
- Date
- 2012-02-09 23:49:35 -0800 (Thu, 09 Feb 2012)
Log Message
Heap-buffer-overflow in WebCore::CSSParser::lex
https://bugs.webkit.org/show_bug.cgi?id=77402
Reviewed by Antti Koivisto.
Source/WebCore:
Comments should check only a single \0 terminator.
Test: fast/css/parsing-css-comment.html
* css/CSSParser.cpp:
(WebCore::CSSParser::lex):
LayoutTests:
Test various comment types.
* fast/css/parsing-css-comment-expected.txt: Added.
* fast/css/parsing-css-comment.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (107368 => 107369)
--- trunk/LayoutTests/ChangeLog 2012-02-10 07:38:15 UTC (rev 107368)
+++ trunk/LayoutTests/ChangeLog 2012-02-10 07:49:35 UTC (rev 107369)
@@ -1,3 +1,15 @@
+2012-02-09 Zoltan Herczeg <[email protected]>
+
+ Heap-buffer-overflow in WebCore::CSSParser::lex
+ https://bugs.webkit.org/show_bug.cgi?id=77402
+
+ Reviewed by Antti Koivisto.
+
+ Test various comment types.
+
+ * fast/css/parsing-css-comment-expected.txt: Added.
+ * fast/css/parsing-css-comment.html: Added.
+
2012-02-09 Kenichi Ishibashi <[email protected]>
Add WebSocket extension support
Added: trunk/LayoutTests/fast/css/parsing-css-comment-expected.txt (0 => 107369)
--- trunk/LayoutTests/fast/css/parsing-css-comment-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/parsing-css-comment-expected.txt 2012-02-10 07:49:35 UTC (rev 107369)
@@ -0,0 +1,19 @@
+Test parsing of CSS nth-child tokens.
+
+SUCCESS
+
+Rules from the stylesheet:
+
+#a { color: green; }
+#b { color: green; }
+#e { color: green; }
+#g { color: green; }
+#i { color: green; }
+Expected result:
+
+#a { color: green; }
+#b { color: green; }
+#e { color: green; }
+#g { color: green; }
+#i { color: green; }
+
Added: trunk/LayoutTests/fast/css/parsing-css-comment.html (0 => 107369)
--- trunk/LayoutTests/fast/css/parsing-css-comment.html (rev 0)
+++ trunk/LayoutTests/fast/css/parsing-css-comment.html 2012-02-10 07:49:35 UTC (rev 107369)
@@ -0,0 +1,75 @@
+<head>
+<style>
+#a { color: green; }
+/*
+ Normal multiline comment
+*/
+#b { color: green; }
+/*
+#c { color: green; }
+*/
+
+/* Single line comment */
+/* #d { color: green; } */
+#e { color: green; }
+
+/*/ Comment start with slash */
+/*/ #f { color: green; } */
+
+/* #g is valid: */
+/**/ #g { color: green; } */
+#h { color: green; }
+/**/#i/**/{/**/color/**/:/**/green/**/;/**/}
+
+/* Unterminated comment. Should not crash.
+</style>
+
+<script>
+
+function runTest()
+{
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ var rules = document.styleSheets[0].cssRules;
+ var text = "";
+ for (var i = 0; i < rules.length; i++) {
+ text += rules.item(i).cssText;
+ text += "\n";
+ }
+
+ document.getElementById("result").appendChild(document.createTextNode(text));
+
+ if (document.getElementById("result").firstChild.data ="" document.getElementById("expected").firstChild.data)
+ document.getElementById("message").firstChild.data = ""
+ else
+ document.getElementById("message").firstChild.data = ""
+}
+
+</script>
+
+</head>
+
+<body _onload_="runTest()">
+
+<p>Test parsing of CSS nth-child tokens.</p>
+
+<p id="message">TEST DID NOT COMPLETE</p>
+
+<p>Rules from the stylesheet:</p>
+
+<pre id="result"></pre>
+
+<p>Expected result:</p>
+
+<pre id="expected">#a { color: green; }
+#b { color: green; }
+#e { color: green; }
+#g { color: green; }
+#i { color: green; }
+</pre>
+
+<script>
+
+</script>
+</body>
Modified: trunk/Source/WebCore/ChangeLog (107368 => 107369)
--- trunk/Source/WebCore/ChangeLog 2012-02-10 07:38:15 UTC (rev 107368)
+++ trunk/Source/WebCore/ChangeLog 2012-02-10 07:49:35 UTC (rev 107369)
@@ -1,3 +1,17 @@
+2012-02-09 Zoltan Herczeg <[email protected]>
+
+ Heap-buffer-overflow in WebCore::CSSParser::lex
+ https://bugs.webkit.org/show_bug.cgi?id=77402
+
+ Reviewed by Antti Koivisto.
+
+ Comments should check only a single \0 terminator.
+
+ Test: fast/css/parsing-css-comment.html
+
+ * css/CSSParser.cpp:
+ (WebCore::CSSParser::lex):
+
2012-02-09 Kentaro Hara <[email protected]>
Replace [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack]
Modified: trunk/Source/WebCore/css/CSSParser.cpp (107368 => 107369)
--- trunk/Source/WebCore/css/CSSParser.cpp 2012-02-10 07:38:15 UTC (rev 107368)
+++ trunk/Source/WebCore/css/CSSParser.cpp 2012-02-10 07:49:35 UTC (rev 107369)
@@ -8525,9 +8525,9 @@
if (*m_currentCharacter == '*') {
++m_currentCharacter;
while (m_currentCharacter[0] != '*' || m_currentCharacter[1] != '/') {
- if (m_currentCharacter[0] == '\n')
+ if (*m_currentCharacter == '\n')
++m_lineNumber;
- if (m_currentCharacter[0] == '\0' && m_currentCharacter[1] == '\0') {
+ if (*m_currentCharacter == '\0') {
// Unterminated comments are simply ignored.
m_currentCharacter -= 2;
break;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
