wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-31 11:37:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Limit the CSS string length for resolved variables to sane values.

Browse source 
This resolves #891
This commit is contained in:
wolfbeast 2018-12-01 12:05:45 +01:00 • committed by Roy Tam
commit 528de62070
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
layout/style/nsCSSParser.cpp
View file

@ -1550,6 +1550,9 @@ protected:
// All data from successfully parsed properties are placed into |mData|. // All data from successfully parsed properties are placed into |mData|.
nsCSSExpandedDataBlock mData; nsCSSExpandedDataBlock mData;
// Value to make sure our resolved variable results stay within sane limits.
const int32_t MAX_CSS_VAR_LENGTH = 10240;
public: public:
// Used from nsCSSParser constructors and destructors // Used from nsCSSParser constructors and destructors
CSSParserImpl* mNextFree; CSSParserImpl* mNextFree;
@ -2802,6 +2805,12 @@ CSSParserImpl::ResolveValueWithVariableReferencesRec(
// Invalid variable with no fallback. // Invalid variable with no fallback.
return false; return false;
} }
// Make sure we are still using sane sizes for value and
// variableValue, and abort if OOB.
if (value.Length() > MAX_CSS_VAR_LENGTH ||
variableValue.Length() > MAX_CSS_VAR_LENGTH) {
return false;
}
// Valid variable with no fallback. // Valid variable with no fallback.
AppendTokens(value, valueFirstToken, valueLastToken, AppendTokens(value, valueFirstToken, valueLastToken,
varFirstToken, varLastToken, variableValue); varFirstToken, varLastToken, variableValue);