Changeset 107369 in webkit

Timestamp:

Feb 9, 2012, 11:49:35 PM (15 years ago)

Author:

zherczeg@webkit.org

Message:

Heap-buffer-overflow in WebCore::CSSParser::lex
​https://bugs.webkit.org/show_bug.cgi?id=77402

Reviewed by Antti Koivisto.

Source/WebCore:

Comments should check only a single \0 terminator.

Test: fast/css/parsing-css-comment.html

• css/CSSParser.cpp:

(WebCore::CSSParser::lex):

LayoutTests:

Test various comment types.

• fast/css/parsing-css-comment-expected.txt: Added.
• fast/css/parsing-css-comment.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/parsing-css-comment-expected.txt (added)
• LayoutTests/fast/css/parsing-css-comment.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/CSSParser.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-02-09  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Heap-buffer-overflow in WebCore::CSSParser::lex
+        https://bugs.webkit.org/show_bug.cgi?id=77402
+
+        Reviewed by Antti Koivisto.
+
+        Test various comment types.
+
+        * fast/css/parsing-css-comment-expected.txt: Added.
+        * fast/css/parsing-css-comment.html: Added.
+
 2012-02-09  Kenichi Ishibashi  <bashi@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-02-09  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Heap-buffer-overflow in WebCore::CSSParser::lex
+        https://bugs.webkit.org/show_bug.cgi?id=77402
+
+        Reviewed by Antti Koivisto.
+
+        Comments should check only a single \0 terminator.
+
+        Test: fast/css/parsing-css-comment.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+
 2012-02-09  Kentaro Hara  <haraken@chromium.org>
 

trunk/Source/WebCore/css/CSSParser.cpp

@@ -8526 +8526 @@
             ++m_currentCharacter;
             while (m_currentCharacter[0] != '*' || m_currentCharacter[1] != '/') {
-                if (m_currentCharacter[0] == '\n')
+                if (*m_currentCharacter == '\n')
                     ++m_lineNumber;
-                if (m_currentCharacter[0] == '\0' && m_currentCharacter[1] == '\0') {
+                if (*m_currentCharacter == '\0') {
                     // Unterminated comments are simply ignored.
                     m_currentCharacter -= 2;