mirror of
https://github.com/RGBCube/serenity
synced 2025-05-31 14:38:11 +00:00
LibWeb: Fix use-after-free in CSSNamespaceRule parsing
Holding the `prefix` as a StringView meant it pointed at string data held by `token`. `token` gets reassigned shortly afterwards, meaning `prefix` would hold invalid character data.
This commit is contained in:
parent
5042c903be
commit
6c2ed0f51b
3 changed files with 6 additions and 6 deletions
|
@ -3331,7 +3331,7 @@ CSSRule* Parser::convert_to_rule(NonnullRefPtr<Rule> rule)
|
|||
token_stream.skip_whitespace();
|
||||
|
||||
auto token = token_stream.next_token();
|
||||
Optional<StringView> prefix = {};
|
||||
Optional<DeprecatedString> prefix = {};
|
||||
if (token.is(Token::Type::Ident)) {
|
||||
prefix = token.token().ident();
|
||||
token_stream.skip_whitespace();
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue