Selaa lähdekoodia

LibWeb: Reject `nullptr` StyleValues as invalid ColorStops

This would cause a nullptr-deref during painting of invalid
linear-gradients, such as `linear-gradient(top, #f8f9fa, #ececec)`
found in googles sign-in button
Hendiadyoin1 1 vuosi sitten
vanhempi
commit
30cb4cb69b
1 muutettua tiedostoa jossa 2 lisäystä ja 2 poistoa
  1. 2 2
      Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp

+ 2 - 2
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp

@@ -2454,13 +2454,13 @@ static Optional<Vector<TElement>> parse_color_stop_list(auto& tokens, auto is_po
             }
             }
             // <T-percentage> <color>
             // <T-percentage> <color>
             auto maybe_color = parse_color(tokens.next_token());
             auto maybe_color = parse_color(tokens.next_token());
-            if (maybe_color.is_error())
+            if (maybe_color.is_error() || maybe_color.value() == nullptr)
                 return ElementType::Garbage;
                 return ElementType::Garbage;
             color = maybe_color.release_value();
             color = maybe_color.release_value();
         } else {
         } else {
             // [<color> <T-percentage>?]
             // [<color> <T-percentage>?]
             auto maybe_color = parse_color(token);
             auto maybe_color = parse_color(token);
-            if (maybe_color.is_error())
+            if (maybe_color.is_error() || maybe_color.value() == nullptr)
                 return ElementType::Garbage;
                 return ElementType::Garbage;
             color = maybe_color.release_value();
             color = maybe_color.release_value();
             tokens.skip_whitespace();
             tokens.skip_whitespace();