233399 - css parser crashes due to out of bounds access on gLexTable

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

nsCSSScanner::Next doesn't bounds-check the result of its call to Peek for
identifiers beginning with a dash.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch (diff -u)

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch (diff -ub)

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 140845 [details] [diff] [review]
patch (diff -ub)

r+sr=bzbarsky

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to trunk, 2004-02-07 23:29 -0800.

Comment 5

[Isaac Hwak Han]

Will this have any impact on bug 232721? Well, I'll try.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 232721 has been marked as a duplicate of this bug. ***

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: additional patch

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 140850 [details] [diff] [review]
additional patch

r+sr=bzbarsky

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 140850 [details] [diff] [review]
additional patch

Checked in to trunk, 2004-02-08 11:22 -0800.

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: yet another patch

While checking the whole file, I noticed I managed to miss this.  I have no
plans to check the whole file again, so this should be it.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 140873 [details] [diff] [review]
yet another patch

r+sr=bzbarsky

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 140873 [details] [diff] [review]
yet another patch

Checked in to trunk, 2004-02-08 11:43 -0800.