0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibWeb: Fix crash parsing an invalid pseudo compound selector

Browse source 
Reduced from a crash on: https://github.com/SerenityOS/serenity/pulls

Fixes #20568
This commit is contained in:
Shannon Booth 2023-08-14 20:42:18 +12:00 • committed by Sam Atkins
parent bf5a17dedb
commit 576f8e8fa8
Notes: sideshowbarker 2024-07-17 01:53:23 +09:00
3 changed files with 19 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
Tests/LibWeb/Layout/expected/css-invalid-psuedo-compound-selector.txt Normal file
View file

@ -0,0 +1,11 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x600 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x0 children: not-inline
BlockContainer <div> at (8,8) content-size 784x0 children: inline
TextNode <#text>
TextNode <#text>
PaintableWithLines (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x600]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x0]
PaintableWithLines (BlockContainer<DIV>) [8,8 784x0]

5
Tests/LibWeb/Layout/input/css-invalid-psuedo-compound-selector.html Normal file
View file

@ -0,0 +1,5 @@
<div>
<style>
:host(:thing) {}
</style>
</div>

6
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
View file

@ -635,13 +635,13 @@ Parser::ParseErrorOr<Selector::SimpleSelector> Parser::parse_pseudo_simple_selec
return parse_nth_child_selector(pseudo_class, pseudo_function.values(), true); return parse_nth_child_selector(pseudo_class, pseudo_function.values(), true);
case PseudoClassMetadata::ParameterType::CompoundSelector: { case PseudoClassMetadata::ParameterType::CompoundSelector: {
auto function_token_stream = TokenStream(pseudo_function.values()); auto function_token_stream = TokenStream(pseudo_function.values());
auto compound_selector = MUST(parse_compound_selector(function_token_stream)); auto compound_selector_or_error = parse_compound_selector(function_token_stream);
if (!compound_selector.has_value()) { if (compound_selector_or_error.is_error() || !compound_selector_or_error.value().has_value()) {
dbgln_if(CSS_PARSER_DEBUG, "Failed to parse :{}() parameter as a compound selector", pseudo_function.name()); dbgln_if(CSS_PARSER_DEBUG, "Failed to parse :{}() parameter as a compound selector", pseudo_function.name());
return ParseError::SyntaxError; return ParseError::SyntaxError;
} }
Vector compound_selectors { compound_selector.release_value() }; Vector compound_selectors { compound_selector_or_error.release_value().release_value() };
auto selector = Selector::create(move(compound_selectors)); auto selector = Selector::create(move(compound_selectors));
return Selector::SimpleSelector { return Selector::SimpleSelector {