changeset 5521:eff80ffc9116

RT-24673: check array index. if out of bounds, report parse error Reviewed by: paru
author David Grieve<david.grieve@oracle.com>
date Thu, 24 Oct 2013 16:40:37 -0400
parents 659cc7864404
children 9b4749e397e9
files modules/graphics/src/main/java/com/sun/javafx/css/StyleManager.java modules/graphics/src/main/java/com/sun/javafx/css/parser/CSSParser.java
diffstat 2 files changed, 14 insertions(+), 9 deletions(-) [+]
line wrap: on
line diff
--- a/modules/graphics/src/main/java/com/sun/javafx/css/StyleManager.java	Thu Oct 24 12:33:29 2013 -0700
+++ b/modules/graphics/src/main/java/com/sun/javafx/css/StyleManager.java	Thu Oct 24 16:40:37 2013 -0400
@@ -1673,18 +1673,23 @@
 
                 List<Selector> selectors = rule != null ? rule.getUnobservedSelectorList() : null;
                 Selector selector = selectors != null && !selectors.isEmpty() ? selectors.get(0) : null;
-                selector.setOrdinal(-1);
 
-                inlineStylesCache.put(inlineStyle, selector);
-                return selector;
+                // selector might be null if parser throws some exception
+                if (selector != null) {
+                    selector.setOrdinal(-1);
 
-            } else {
+                    inlineStylesCache.put(inlineStyle, selector);
+                    return selector;
+                }
+                // if selector is null, fall through
 
-                // even if inlineStylesheet is null, put it in cache so we don't
-                // bother with trying to parse it again.
-                inlineStylesCache.put(inlineStyle, null);
-                return null;
             }
+
+            // even if selector is null, put it in cache so we don't
+            // bother with trying to parse it again.
+            inlineStylesCache.put(inlineStyle, null);
+            return null;
+
         }
 
         private Map<StyleCache.Key,StyleCache> styleCache;
--- a/modules/graphics/src/main/java/com/sun/javafx/css/parser/CSSParser.java	Thu Oct 24 12:33:29 2013 -0700
+++ b/modules/graphics/src/main/java/com/sun/javafx/css/parser/CSSParser.java	Thu Oct 24 16:40:37 2013 -0400
@@ -2933,7 +2933,7 @@
         int paint = 0;
 
         while(term != null) {
-            if (term.token == null) error(term, "Expected \'<paint>\'");
+            if (term.token == null || paints.length <= paint) error(term, "Expected \'<paint>\'");
             paints[paint++] = parse(term);
             term = term.nextInSeries;
         }