Skip to content

Commit

Permalink
LibWeb: Use substrings instead of pointers when parsing unicode ranges
Browse files Browse the repository at this point in the history
Fixes a segfault when parsing a wildcard-only unicode range

(cherry picked from commit a4b38dda5611e87987c855de8a6e06aa0351bd1b)
  • Loading branch information
Gingeh authored and nico committed Nov 25, 2024
1 parent 4f2372f commit 9c39630
Show file tree
Hide file tree
Showing 3 changed files with 14 additions and 1 deletion.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
PASS (didn't crash)
11 changes: 11 additions & 0 deletions Tests/LibWeb/Text/input/css/unicode-range-all-wildcard.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
<style>
@font-face {
unicode-range: U+??;
}
</style>
<script src="../include.js"></script>
<script>
test(() => {
println("PASS (didn't crash)");
});
</script>
3 changes: 2 additions & 1 deletion Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2413,6 +2413,7 @@ Optional<Gfx::UnicodeRange> Parser::parse_unicode_range(StringView text)

// 3. Consume as many hex digits from text as possible.
// then consume as many U+003F QUESTION MARK (?) code points as possible.
auto start_position = lexer.tell();
auto hex_digits = lexer.consume_while(is_ascii_hex_digit);
auto question_marks = lexer.consume_while([](auto it) { return it == '?'; });
// If zero code points were consumed, or more than six code points were consumed,
Expand All @@ -2422,7 +2423,7 @@ Optional<Gfx::UnicodeRange> Parser::parse_unicode_range(StringView text)
dbgln_if(CSS_PARSER_DEBUG, "CSSParser: <urange> start value had {} digits/?s, expected between 1 and 6.", consumed_code_points);
return {};
}
StringView start_value_code_points { hex_digits.characters_without_null_termination(), consumed_code_points };
StringView start_value_code_points = text.substring_view(start_position, consumed_code_points);

// If any U+003F QUESTION MARK (?) code points were consumed, then:
if (question_marks.length() > 0) {
Expand Down

0 comments on commit 9c39630

Please sign in to comment.