[Webkit-unassigned] [Bug 218093] [css-logical] Implement logical border-radius
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Jan 11 10:28:42 PST 2021
https://bugs.webkit.org/show_bug.cgi?id=218093
Simon Fraser (smfr) <simon.fraser at apple.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #417266|review? |review-
Flags| |
--- Comment #46 from Simon Fraser (smfr) <simon.fraser at apple.com> ---
Comment on attachment 417266
--> https://bugs.webkit.org/attachment.cgi?id=417266
Patch
View in context: https://bugs.webkit.org/attachment.cgi?id=417266&action=review
> Source/WebCore/css/CSSProperty.cpp:63
> +static CSSPropertyID resolveToPhysicalProperty(TextDirection direction, WritingMode writingMode, LogicalBoxCorner logicalBoxCorner, const StylePropertyShorthand& shorthand)
> +{
> + return shorthand.properties()[static_cast<size_t>(mapLogicalCornerToPhysicalCorner(makeTextFlow(writingMode, direction), logicalBoxCorner))];
> +}
This code is unsafe. If it's called with some random StylePropertyShorthand (not border-radius) then it can run off the end of the properties() array.
Since you only call this for borderRadiusShorthand(), make it explicitly about border-radius.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210111/d49fc313/attachment.htm>
More information about the webkit-unassigned
mailing list