2009-12-05 Adam Langley <agl@google.com>
authorabarth@webkit.org <abarth@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 5 Dec 2009 17:50:53 +0000 (17:50 +0000)
committerabarth@webkit.org <abarth@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 5 Dec 2009 17:50:53 +0000 (17:50 +0000)
        Reviewed by Adam Barth.

        Check that a CSS format() argument is of a valid type.

        https://bugs.webkit.org/show_bug.cgi?id=31815
        http://code.google.com/p/chromium/issues/detail?id=28582

        * fast/css/url-format-non-string-expected.txt: Added
        * fast/css/url-format-non-string.html: Added.
2009-12-05  Adam Langley  <agl@google.com>

        Reviewed by Adam Barth.

        Check that a CSS format() argument is of a valid type.

        https://bugs.webkit.org/show_bug.cgi?id=31815
        http://code.google.com/p/chromium/issues/detail?id=28582

        Test: fast/css/url-format-non-string.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFontFaceSrc):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@51727 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css/url-format-non-string-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/url-format-non-string.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/css/CSSParser.cpp

index 80a53c491c71b0f2e6a3bba66f071657887c064b..cee6e54307a9e50a1e9a9f16e8c4048ad2c56cef 100644 (file)
@@ -1,3 +1,15 @@
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        * fast/css/url-format-non-string-expected.txt: Added
+        * fast/css/url-format-non-string.html: Added.
+
 2009-12-04  Kent Hansen  <kent.hansen@nokia.com>
 
         Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/css/url-format-non-string-expected.txt b/LayoutTests/fast/css/url-format-non-string-expected.txt
new file mode 100644 (file)
index 0000000..7ef22e9
--- /dev/null
@@ -0,0 +1 @@
+PASS
diff --git a/LayoutTests/fast/css/url-format-non-string.html b/LayoutTests/fast/css/url-format-non-string.html
new file mode 100644 (file)
index 0000000..caf5dd7
--- /dev/null
@@ -0,0 +1,19 @@
+<html>
+  <head>
+    <script>
+      if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    </script>
+
+    <style media="all" type="text/css">
+      body {
+        src: url() format(attr(r));
+      }
+    </style>
+  </head>
+    <!-- This previously triggered the use of uninitialised memory. Thanks to
+         Robert Swiecki for the test case. -->
+    <p>PASS</p>
+  <body>
+  </body>
+</html>
index 4bf7f58404fc64dc92c2be02f9283f4baf6b2575..93631dc441e12693a7b7effa5961eff97b3cee4f 100644 (file)
@@ -1,3 +1,17 @@
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
 2009-12-04  Adam Langley  <agl@google.com>
 
         Reviewed by Eric Seidel.
index 5e09f102c31e2c491a005f2ad1f7f6eccdb5cc47..b4beabac467010e71ff721eece754047b0852f70 100644 (file)
@@ -3337,6 +3337,12 @@ bool CSSParser::parseFontWeight(bool important)
     return false;
 }
 
+static bool isValidFormatFunction(CSSParserValue* val)
+{
+    CSSParserValueList* args = val->function->args;
+    return equalIgnoringCase(val->function->name, "format(") && (args->current()->unit == CSSPrimitiveValue::CSS_STRING || args->current()->unit == CSSPrimitiveValue::CSS_IDENT);
+}
+
 bool CSSParser::parseFontFaceSrc()
 {
     RefPtr<CSSValueList> values(CSSValueList::createCommaSeparated());
@@ -3364,7 +3370,7 @@ bool CSSParser::parseFontFaceSrc()
                     CSSParserValue* a = args->current();
                     uriValue.clear();
                     parsedValue = CSSFontFaceSrcValue::createLocal(a->string);
-                } else if (equalIgnoringCase(val->function->name, "format(") && allowFormat && uriValue) {
+                } else if (allowFormat && uriValue && isValidFormatFunction(val)) {
                     expectComma = true;
                     allowFormat = false;
                     uriValue->setFormat(args->current()->string);