refactor Css_parse_selector() to avoid looping

Make sure that even if parsing of a CSS selector fails, the parser
advances until the end of the selector (EOF, ',', or '{').

1 files changed, 13 insertions, 4 deletions

diff --git a/src/cssparser.cc b/src/cssparser.cc
index e088fc8e..075d6d6e 100644
--- a/src/cssparser.cc
+++ b/src/cssparser.cc
@@ -1045,12 +1045,15 @@ static CssSelector *Css_parse_selector(CssParser * parser) {
    CssSelector *selector = new CssSelector ();
 
    while (true) {
-      if (! Css_parse_simple_selector (parser, selector->top ()))
-         Css_next_token(parser); /* make sure we advance at least one token */
+      if (! Css_parse_simple_selector (parser, selector->top ())) {
+         delete selector;
+         selector = NULL;
+         break;
+      }
 
       if (parser->ttype == CSS_TK_CHAR &&
          (parser->tval[0] == ',' || parser->tval[0] == '{')) {
-         return selector;
+         break;
       } else if (parser->ttype == CSS_TK_CHAR && parser->tval[0] == '>') {
          selector->addSimpleSelector (CssSelector::CHILD);
          Css_next_token(parser);
@@ -1058,10 +1061,16 @@ static CssSelector *Css_parse_selector(CssParser * parser) {
          selector->addSimpleSelector (CssSelector::DESCENDENT);
       } else {
          delete selector;
-         return NULL;
+         selector = NULL;
+         break;
       }
    }
 
+   while (parser->ttype != CSS_TK_END &&
+          (parser->ttype != CSS_TK_CHAR ||
+           (parser->tval[0] != ',' && parser->tval[0] != '{')))
+         Css_next_token(parser);
+
    return selector;
 }