Skip to content

Commit 95f307e

Browse files
authored
Fix segfault with invalid map keys (#2368)
Originally reported by @MrTuxracer via HackerOne. The changed to using even sized lists to represent maps during the parse stage inadvertently removed certain parser-time error guarantees. The results being that invalid keys could make their way into the lists and cause segfaults during eval. This PR adds parser-time error handling for the most likely error case. Spec sass/sass-spec#1104
1 parent 4ccec02 commit 95f307e

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

src/parser.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1061,6 +1061,11 @@ namespace Sass {
10611061
if (!lex_css< exactly<':'> >())
10621062
{ return key; }
10631063

1064+
List_Obj l = Cast<List>(key);
1065+
if (l && l->separator() == SASS_COMMA) {
1066+
css_error("Invalid CSS", " after ", ": expected \")\", was ");
1067+
}
1068+
10641069
Expression_Obj value = parse_space_list();
10651070

10661071
map->append(key);

0 commit comments

Comments
 (0)