Browse Source

LibWeb: Fix StringView OOB access when parsing 3-character legacy color

Found by Domato.
Andreas Kling 1 year ago
parent
commit
1c00e5688d

+ 1 - 0
Tests/LibWeb/Text/expected/HTML/short-legacy-color-value.txt

@@ -0,0 +1 @@
+  PASS (didn't crash)

+ 7 - 0
Tests/LibWeb/Text/input/HTML/short-legacy-color-value.html

@@ -0,0 +1,7 @@
+<script src="../include.js"></script>
+<body bgcolor="foo">
+<script>
+    test(() => {
+        println("PASS (didn't crash)");
+    });
+</script>

+ 3 - 0
Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp

@@ -4879,6 +4879,9 @@ Optional<Color> parse_legacy_color_value(StringView string)
     }
 
     auto to_hex = [&](StringView string) -> u8 {
+        if (length == 1) {
+            return hex_nibble_to_u8(string[0]);
+        }
         auto nib1 = hex_nibble_to_u8(string[0]);
         auto nib2 = hex_nibble_to_u8(string[1]);
         return nib1 << 4 | nib2;