GNOME Bugzilla – Bug 459403
bugs in parsing color names [PATCH]
Last modified: 2011-12-11 20:19:31 UTC
There are two bugs in the parsing of named colors ("color: blue"): - Accessing bad memory when no match. (Uses sizeof(array) without dividing by sizeof(array element).) - Does case-sensitive comparisons, contrary to the rule CSS2 should be parsed case-insensitively (except for references to names outside of CSS): http://www.w3.org/TR/REC-CSS2/syndata.html#q4. The attached patch corrects both of these issues. Granted there remain many parts of libcroco that wrongly do case-sensitive comparisons. I send a patch for this function in particular because I found a stylesheet “in the wild” (in Wikipedia, no less) that uses ‘Black’ as a color. A buglet in the attached patch: it uses g_ascii_strdown, which will (via g_malloc and g_error) cause the program to abort on out-of-memory. For small devices, we'd prefer to return CR_OUT_OF_MEMORY_ERROR. If you like, I can code for this (strlen, g_try_malloc, if null then return CR_OUT_OF_MEMORY_ERROR else g_ascii_tolower in a loop). Possibly there should be a g_try_ascii_strdown in glib (returning NULL if no memory), though I don't know what glib developers would say to the idea of ~doubling the number of string functions in glib with try variants.
Created attachment 92183 [details] [review] patch to do case-insensitive comparisons of color names Correction to the initial bug description: current SVN of libcroco has already fixed the bug of when no matching color (sizeof/G_N_ELEMENTS). The attached patch then just addresses the case-sensitive comparison issue.
Fixed on git master.