LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-11 05:25:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Fix StringView OOB access when parsing 3-character legacy color

Browse Source 
Found by Domato.
This commit is contained in:
Andreas Kling 2024-07-19 14:44:10 +02:00 committed by Andreas Kling
parent 7360f7fbc6
commit 1c00e5688d
Notes: github-actions[bot] 2024-07-20 07:32:06 +00:00 
Author: https://github.com/awesomekling
Commit: https://github.com/LadybirdBrowser/ladybird/commit/1c00e5688d3
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/721
3 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/HTML/short-legacy-color-value.txt Normal file
View File

@ -0,0 +1 @@
PASS (didn't crash)

7
Tests/LibWeb/Text/input/HTML/short-legacy-color-value.html Normal file
View File

@ -0,0 +1,7 @@
<script src="../include.js"></script>
<body bgcolor="foo">
<script>
test(() => {
println("PASS (didn't crash)");
});
</script>

3
Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp
View File

@ -4879,6 +4879,9 @@ Optional<Color> parse_legacy_color_value(StringView string)
}
auto to_hex = [&](StringView string) -> u8 {
if (length == 1) {
return hex_nibble_to_u8(string[0]);
}
auto nib1 = hex_nibble_to_u8(string[0]);
auto nib2 = hex_nibble_to_u8(string[1]);
return nib1 << 4 | nib2;