mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-05-02 01:08:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Fix Array OOBs in the HTMLTokenizer

Browse source 
Accessing last() if there are no elements makes WebContent crash :^)
This commit is contained in:
stelar7 2022-06-02 01:03:44 +02:00 • committed by Linus Groh
parent 997890c94e
commit e547f5887e
Notes: sideshowbarker 2024-07-17 10:29:20 +09:00
1 changed files with 16 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

26
Userland/Libraries/LibWeb/HTML/Parser/HTMLTokenizer.cpp
View file

@ -210,15 +210,18 @@ Optional<u32> HTMLTokenizer::next_code_point()
void HTMLTokenizer::skip(size_t count)
{
m_source_positions.append(m_source_positions.last());
if (!m_source_positions.is_empty())
m_source_positions.append(m_source_positions.last());
for (size_t i = 0; i < count; ++i) {
m_prev_utf8_iterator = m_utf8_iterator;
auto code_point = *m_utf8_iterator;
if (code_point == '\n') {
m_source_positions.last().column = 0;
m_source_positions.last().line++;
} else {
m_source_positions.last().column++;
if (!m_source_positions.is_empty()) {
if (code_point == '\n') {
m_source_positions.last().column = 0;
m_source_positions.last().line++;
} else {
m_source_positions.last().column++;
}
}
++m_utf8_iterator;
}
@ -245,7 +248,7 @@ HTMLToken::Position HTMLTokenizer::nth_last_position(size_t n)
Optional<HTMLToken> HTMLTokenizer::next_token()
{
{
if (!m_source_positions.is_empty()) {
auto last_position = m_source_positions.last();
m_source_positions.clear_with_capacity();
m_source_positions.append(move(last_position));
@ -1190,7 +1193,8 @@ _StartOfFunction:
ANYTHING_ELSE
{
m_current_token.add_attribute({});
m_current_token.last_attribute().name_start_position = m_source_positions.last();
if (!m_source_positions.is_empty())
m_current_token.last_attribute().name_start_position = m_source_positions.last();
RECONSUME_IN(AttributeName);
}
}
@ -2867,8 +2871,10 @@ void HTMLTokenizer::restore_to(Utf8CodePointIterator const& new_iterator)
{
auto diff = m_utf8_iterator - new_iterator;
if (diff > 0) {
for (ssize_t i = 0; i < diff; ++i)
m_source_positions.take_last();
for (ssize_t i = 0; i < diff; ++i) {
if (!m_source_positions.is_empty())
m_source_positions.take_last();
}
} else {
// Going forwards...?
TODO();