RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 22:37:35 +00:00
Code Issues Activity Actions

LibWeb/CSS: Remove nullpointer dereference in Parser

Browse source 
On platinenmacher.tech there is a document without a window. During
size attribute parsing the window pointer is dereferenced which
causes a crash. This checks for the window to be actually there
before dereferencing.
This commit is contained in:
Bastian Neumann 2024-01-07 16:38:09 +01:00 • committed by Sam Atkins
parent 343d6b001f
commit 7d63b8b95f
2 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
View file

@ -6648,7 +6648,8 @@ LengthOrCalculated Parser::Parser::parse_as_sizes_attribute()
// If it does not parse correctly, or it does parse correctly but the <media-condition> evaluates to false, continue. // If it does not parse correctly, or it does parse correctly but the <media-condition> evaluates to false, continue.
TokenStream<ComponentValue> token_stream { unparsed_size }; TokenStream<ComponentValue> token_stream { unparsed_size };
auto media_condition = parse_media_condition(token_stream, MediaCondition::AllowOr::Yes); auto media_condition = parse_media_condition(token_stream, MediaCondition::AllowOr::Yes);
if (media_condition && media_condition->evaluate(*m_context.window()) == MatchResult::True) { auto context_window = m_context.window();
if (context_window && media_condition && media_condition->evaluate(*context_window) == MatchResult::True) {
return size.value(); return size.value();
} else { } else {
continue; continue;

2
Userland/Libraries/LibWeb/CSS/Parser/ParsingContext.cpp
View file

@ -56,7 +56,7 @@ AK::URL ParsingContext::complete_url(StringView relative_url) const
HTML::Window const* ParsingContext::window() const HTML::Window const* ParsingContext::window() const
{ {
return m_document ? &m_document->window() : nullptr; return m_document && m_document->default_view() ? &m_document->window() : nullptr;
} }
} }