[Webkit-unassigned] [Bug 218093] [css-logical] Implement logical border-radius

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Jan 11 10:28:42 PST 2021


https://bugs.webkit.org/show_bug.cgi?id=218093

Simon Fraser (smfr) <simon.fraser at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #417266|review?                     |review-
              Flags|                            |

--- Comment #46 from Simon Fraser (smfr) <simon.fraser at apple.com> ---
Comment on attachment 417266
  --> https://bugs.webkit.org/attachment.cgi?id=417266
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=417266&action=review

> Source/WebCore/css/CSSProperty.cpp:63
> +static CSSPropertyID resolveToPhysicalProperty(TextDirection direction, WritingMode writingMode, LogicalBoxCorner logicalBoxCorner, const StylePropertyShorthand& shorthand)
> +{
> +    return shorthand.properties()[static_cast<size_t>(mapLogicalCornerToPhysicalCorner(makeTextFlow(writingMode, direction), logicalBoxCorner))];
> +}

This code is unsafe. If it's called with some random StylePropertyShorthand (not border-radius) then it can run off the end of the properties() array.

Since you only call this for borderRadiusShorthand(), make it explicitly about border-radius.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210111/d49fc313/attachment.htm>


More information about the webkit-unassigned mailing list