AuroraMiddleware/gtk2
1
0
Fork 0
forked from AuroraMiddleware/gtk
Code Issues Pull Requests Projects Releases Wiki Activity

Fix crash in parse_border()

Browse Source 
The bug was introduced in commit:
	9b7640b8 by Benjamin Otte, 2012-03-26 17:24:02
	styleproperty: Make _gtk_style_property_parse_value() return a CssValue

In that commit, `values` changed from `GValue*` to `GtkCssValue**`,
but one `!G_IS_VALUE (&values[8])` was left untouched. As a result,
if `border` shorthand contains anything after color, it might crash,
depending on memory layout.

New test included.

Fixes: #751
This commit is contained in:
Alexandr Miloslavskiy 2019-11-21 20:26:22 +01:00 committed by Benjamin Otte
parent e3c3cbbbcb
commit fd1630e049
5 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
gtk/gtkcssshorthandpropertyimpl.c
View File

@ -387,7 +387,7 @@ parse_border (GtkCssShorthandProperty *shorthand,
values[6] = _gtk_css_value_ref (values[4]); values[6] = _gtk_css_value_ref (values[4]);
values[7] = _gtk_css_value_ref (values[4]); values[7] = _gtk_css_value_ref (values[4]);
} }
else if (!G_IS_VALUE (&values[8])) else if (values[8] == NULL)
{ {
values[8] = _gtk_css_color_value_parse (parser); values[8] = _gtk_css_color_value_parse (parser);
if (values[8] == NULL) if (values[8] == NULL)

4
testsuite/css/parser/border-crash-3.24.css Normal file
View File

@ -0,0 +1,4 @@
* {
border: 2px solid alpha(black, 0.3)
padding: 2px;
}

1
testsuite/css/parser/border-crash-3.24.errors Normal file
View File

@ -0,0 +1 @@
border-crash-3.24.css:3: error: GTK_CSS_PROVIDER_ERROR_SYNTAX

0
testsuite/css/parser/border-crash-3.24.ref.css Normal file
View File

7
testsuite/css/parser/meson.build
View File

@ -156,12 +156,15 @@ test_data = [
'backslash-eof-is-identifier.css', 'backslash-eof-is-identifier.css',
'backslash-eof-is-identifier.errors', 'backslash-eof-is-identifier.errors',
'backslash-eof-is-identifier.ref.css', 'backslash-eof-is-identifier.ref.css',
'border.css',
'border.errors',
'border-color.css', 'border-color.css',
'border-color-currentcolor.css', 'border-color-currentcolor.css',
'border-color-currentcolor.ref.css', 'border-color-currentcolor.ref.css',
'border-color.ref.css', 'border-color.ref.css',
'border.css', 'border-crash-3.24.css',
'border.errors', 'border-crash-3.24.errors',
'border-crash-3.24.ref.css',
'border-image-repeat.css', 'border-image-repeat.css',
'border-image-repeat.ref.css', 'border-image-repeat.ref.css',
'border-image-slice.css', 'border-image-slice.css',