From 2e0a8f0ab03e48d823d391d9f77e1e96d68b7796 Mon Sep 17 00:00:00 2001
From: Steinar H. Gunderson <sesse@chromium.org>
Date: Thu, 19 Feb 2026 05:43:25 -0800
Subject: [PATCH] Fix reading of invalid data in Typed OM.

After seeing var(, we would not properly check that the next token
was an ident, and would just call Value(), potentially reading
uninitialized data. Our fix has a little defense in depth:

 1. For this specific case, we check the token type. (The spec is not
    exactly clear on exactly _what_ we should do, but right now,
    we abort the parsing. We should probably throw an exception,
    but getting an ExceptionState all the way down here is not trivial.)
 2. For CSSParserTokens without a value, we add a DCHECK if someone
    calls Value().
 3. In addition, we explicitly initialize data_length_ to zero,
    so that if someone calls Value() in a non-DCHECK build, we'll
    get an empty token instead of uninitialized data.

Style perftest parsing performance is neutral.

Fixed: 484811719
Change-Id: I749989639af9836abc74f90de9135c08cad804d2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7593255
Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Commit-Queue: Steinar H Gunderson <sesse@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1587044}
---

diff --git a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
index 3d43306..486e9d1 100644
--- a/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_unparsed_value.cc
@@ -19,7 +19,11 @@
 
 String FindVariableName(CSSParserTokenStream& stream) {
   stream.ConsumeWhitespace();
-  return stream.Consume().Value().ToString();
+  if (stream.Peek().GetType() == CSSParserTokenType::kIdentToken) {
+    return stream.Consume().Value().ToString();
+  } else {
+    return {};
+  }
 }
 
 V8CSSUnparsedSegment* VariableReferenceValue(
@@ -35,6 +39,11 @@
   CSSStyleVariableReferenceValue* variable_reference =
       CSSStyleVariableReferenceValue::Create(variable_name.ToString(),
                                              unparsed_value);
+  if (!variable_reference) {
+    // TODO(sesse): Plumb the ExceptionState here so that we can use
+    // the Create() variant that properly throws an exception.
+    return nullptr;
+  }
   return MakeGarbageCollected<V8CSSUnparsedSegment>(variable_reference);
 }
 
@@ -57,8 +66,12 @@
       if (stream.Peek().GetType() == CSSParserTokenType::kCommaToken) {
         stream.Consume();
       }
-      tokens.push_back(VariableReferenceValue(
-          variable_name, ParserTokenStreamToTokens(stream)));
+      V8CSSUnparsedSegment* ref = VariableReferenceValue(
+          variable_name, ParserTokenStreamToTokens(stream));
+      if (!ref) {
+        break;
+      }
+      tokens.push_back(ref);
     } else {
       if (stream.Peek().GetBlockType() == CSSParserToken::kBlockStart) {
         ++nesting_level;
diff --git a/third_party/blink/renderer/core/css/parser/css_parser_token.h b/third_party/blink/renderer/core/css/parser/css_parser_token.h
index 0f8efb7..b294c9dc3 100644
--- a/third_party/blink/renderer/core/css/parser/css_parser_token.h
+++ b/third_party/blink/renderer/core/css/parser/css_parser_token.h
@@ -93,7 +93,8 @@
         unit_(0),                // Don't care.
         value_is_inline_(false),
         value_is_8bit_(false),  // Don't care.
-        padding_(0)             // Don't care.
+        padding_(0),            // Don't care.
+        value_length_(0)        // For security.
   {}
 
   // The resulting CSSParserToken may hold a reference to the data in value.
@@ -128,6 +129,9 @@
     return static_cast<CSSParserTokenType>(type_);
   }
   StringView Value() const {
+#if DCHECK_IS_ON()
+    DCHECK(has_value_);
+#endif
     return value_is_8bit_ ? StringView(Span8()) : StringView(Span16());
   }
 
@@ -221,6 +225,9 @@
       value_data_char_raw_ = string.Bytes();
       value_is_inline_ = false;
     }
+#if DCHECK_IS_ON()
+    has_value_ = true;
+#endif
   }
   bool ValueDataCharRawEqual(const CSSParserToken& other) const;
   const void* ValueDataCharRaw() const {
@@ -268,8 +275,15 @@
   // tightly with the rest of this object for a smaller object size.
   unsigned value_is_8bit_ : 1;
 
+#if DCHECK_IS_ON()
+  unsigned has_value_ : 1 = false;
+
+  // These are free bits. You may take from them if you need.
+  [[maybe_unused]] unsigned padding_ : 11;
+#else
   // These are free bits. You may take from them if you need.
   [[maybe_unused]] unsigned padding_ : 12;
+#endif
 
   unsigned value_length_;
   union {
diff --git a/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html b/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html
new file mode 100644
index 0000000..b92bd62d
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<title>Crash Test: Missing variable name in CSSUnparsedValue</title>
+<link rel="help" href="https://issues.chromium.org/issues/484811719">
+<div id="div"></div>
+<script>
+  for (let i = 0; i < 5000; ++i) {
+    const bad = new CSSUnparsedValue(['var(,)']);
+    div.attributeStyleMap.set('--x', bad);
+    div.attributeStyleMap.get('--x');
+  }
+</script>
+<p>PASS if no crash</p>

diff --git a/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html b/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html
new file mode 100644
index 0000000..b92bd62d
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-typed-om/missing-variable-in-unparsed-value-crash.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<title>Crash Test: Missing variable name in CSSUnparsedValue</title>
+<link rel="help" href="https://issues.chromium.org/issues/484811719">
+<div id="div"></div>
+<script>
+  for (let i = 0; i < 5000; ++i) {
+    const bad = new CSSUnparsedValue(['var(,)']);
+    div.attributeStyleMap.set('--x', bad);
+    div.attributeStyleMap.get('--x');
+  }
+</script>
+<p>PASS if no crash</p>