Sfoglia il codice sorgente

LibWeb: Reject `nullptr` StyleValues as invalid ColorStops

This would cause a nullptr-deref during painting of invalid
linear-gradients, such as `linear-gradient(top, #f8f9fa, #ececec)`
found in googles sign-in button
Hendiadyoin1 1 anno fa
parent
commit
30cb4cb69b
1 ha cambiato i file con 2 aggiunte e 2 eliminazioni
  1. 2 2
      Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp

+ 2 - 2
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp

@@ -2454,13 +2454,13 @@ static Optional<Vector<TElement>> parse_color_stop_list(auto& tokens, auto is_po
             }
             // <T-percentage> <color>
             auto maybe_color = parse_color(tokens.next_token());
-            if (maybe_color.is_error())
+            if (maybe_color.is_error() || maybe_color.value() == nullptr)
                 return ElementType::Garbage;
             color = maybe_color.release_value();
         } else {
             // [<color> <T-percentage>?]
             auto maybe_color = parse_color(token);
-            if (maybe_color.is_error())
+            if (maybe_color.is_error() || maybe_color.value() == nullptr)
                 return ElementType::Garbage;
             color = maybe_color.release_value();
             tokens.skip_whitespace();