Skip to content

css_parse: Ensure buffer is refilled if skipping past a whole buffer - #1180

Merged
keithamus merged 1 commit into
mainfrom
css-parse-ensure-buffer-is-refilled-if-skipping-past-a-whole-buffer
Jun 5, 2026
Merged

css_parse: Ensure buffer is refilled if skipping past a whole buffer#1180
keithamus merged 1 commit into
mainfrom
css-parse-ensure-buffer-is-refilled-if-skipping-past-a-whole-buffer

Conversation

@keithamus

@keithamus keithamus commented Jun 5, 2026

Copy link
Copy Markdown
Member

It's possible to cause a panic in csskit by filling the buffer with skip tokens,
such as comments: 11 comment tokens in a row will cause the next icon to reach
the end of the buffer, and cause an index OOB panic. This occurs because
next() unconditionally calls buffer_index = i + 1 for skip tokens, so when
the buffer landed at slot 11, buffer_index becomes 12 (OOB).

This change ensures the buffer is refilled, even when skipping tokens, by
refactoring to add an outer loop and ensuring skip tokens don't advance the
buffer in the inner loop. fill_buffer gets called at the end of the outer loop
to ensure it is not exhausted.

@keithamus
css_parse: Ensure buffer is refilled if skipping past a whole buffer
f0536ff 
It's possible to cause a panic in csskit by filling the buffer with skip tokens,
such as comments: 11 comment tokens in a row will cause the next icon to reach
the end of the buffer, and cause an index OOB panic. This occurs because
`next()` unconditionally calls `buffer_index = i + 1` for skip tokens, so when
the buffer landed at slot 11, `buffer_index` becomes 12 (OOB).

This change ensures the buffer is refilled, even when skipping tokens, by
refactoring to add an outer loop and ensuring skip tokens don't advance the
buffer in the inner loop. `fill_buffer` gets called at the end of the outer loop
to ensure it is not exhausted.
@keithamus
keithamus enabled auto-merge (squash) June 5, 2026 17:43
github-actions[bot]
github-actions Bot approved these changes Jun 5, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All CI jobs have passed. Approving.

@keithamus
keithamus merged commit 6e0cae8 into main Jun 5, 2026
17 checks passed
@keithamus
keithamus deleted the css-parse-ensure-buffer-is-refilled-if-skipping-past-a-whole-buffer branch June 5, 2026 17:51
@keithamus keithamus mentioned this pull request Jun 5, 2026
Merged
github-actions Bot pushed a commit that referenced this pull request Jun 5, 2026
@keithamus
Canary Release
bbdebd7 
## [0.0.25] - 2026-06-05

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
github-actions Bot pushed a commit that referenced this pull request Jun 5, 2026
@keithamus
Release: v0.0.25
b52e345 
## [0.0.25] - 2026-06-05

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 5, 2026
@keithamus
Canary Release
e2131bf 
## [0.0.25] - 2026-06-05

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
github-actions Bot pushed a commit that referenced this pull request Jun 5, 2026
@keithamus
Release: v0.0.25
15a6b5d 
## [0.0.25] - 2026-06-05

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 5, 2026
@keithamus
Canary Release
7f4a601 
## [0.0.25] - 2026-06-05

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
github-actions Bot pushed a commit that referenced this pull request Jun 8, 2026
@keithamus
Release: v0.0.25
a68e1a2 
## [0.0.25] - 2026-06-08

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 8, 2026
@keithamus
Canary Release
e36f41d 
## [0.0.25] - 2026-06-08

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))
github-actions Bot pushed a commit that referenced this pull request Jun 8, 2026
@keithamus
Release: v0.0.25
c68a1c8 
## [0.0.25] - 2026-06-08

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 8, 2026
@keithamus
Canary Release
8795cbb 
## [0.0.25] - 2026-06-08

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))
github-actions Bot pushed a commit that referenced this pull request Jun 10, 2026
@keithamus
Release: v0.0.25
401ebce 
## [0.0.25] - 2026-06-10

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))
- css_ast: Use assert_parse! closure macro variant in tests. (#1196) ([#1196](#1196))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))
- Impl Display for Comparison (#1193) ([#1193](#1193))
- css_parse: Improve assert_parse! macros to use a block/closure (#1194) ([#1194](#1194))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 10, 2026
@keithamus
Canary Release
80999a2 
## [0.0.25] - 2026-06-10

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))
- css_ast: Use assert_parse! closure macro variant in tests. (#1196) ([#1196](#1196))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))
- Impl Display for Comparison (#1193) ([#1193](#1193))
- css_parse: Improve assert_parse! macros to use a block/closure (#1194) ([#1194](#1194))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))
github-actions Bot pushed a commit that referenced this pull request Jun 12, 2026
@keithamus
Release: v0.0.25
e51641e 
## [0.0.25] - 2026-06-12

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))
- Fuzz: Try setting up a fuzzing suite (#1201) ([#1201](#1201))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))
- css_ast: Use assert_parse! closure macro variant in tests. (#1196) ([#1196](#1196))
- cssast/csskit_derives: Add new FeatureMetadata system (#1197) ([#1197](#1197))
- csskit_derives/css_ast: make derive(IntoCursor) work with generics (#1200) ([#1200](#1200))
- css_ast: Implement a NonEmpty generic (#1202) ([#1202](#1202))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))
- Impl Display for Comparison (#1193) ([#1193](#1193))
- css_parse: Improve assert_parse! macros to use a block/closure (#1194) ([#1194](#1194))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_derives
- csskit_derives: Ensure generics expect Peek when using it. (#1198) ([#1198](#1198))

### Csskit_source_finder
- csskit_source_finder: Don't find visitable nodes that just visit children (#1199) ([#1199](#1199))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 12, 2026
@keithamus
Canary Release
dbcc7f6 
## [0.0.25] - 2026-06-12

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))
- Fuzz: Try setting up a fuzzing suite (#1201) ([#1201](#1201))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))
- css_ast: Use assert_parse! closure macro variant in tests. (#1196) ([#1196](#1196))
- cssast/csskit_derives: Add new FeatureMetadata system (#1197) ([#1197](#1197))
- csskit_derives/css_ast: make derive(IntoCursor) work with generics (#1200) ([#1200](#1200))
- css_ast: Implement a NonEmpty generic (#1202) ([#1202](#1202))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))
- Impl Display for Comparison (#1193) ([#1193](#1193))
- css_parse: Improve assert_parse! macros to use a block/closure (#1194) ([#1194](#1194))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_derives
- csskit_derives: Ensure generics expect Peek when using it. (#1198) ([#1198](#1198))

### Csskit_source_finder
- csskit_source_finder: Don't find visitable nodes that just visit children (#1199) ([#1199](#1199))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))
github-actions Bot pushed a commit that referenced this pull request Jun 13, 2026
@keithamus
Release: v0.0.25
2002a37 
## [0.0.25] - 2026-06-13

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))
- Fuzz: Try setting up a fuzzing suite (#1201) ([#1201](#1201))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))
- css_ast: Use assert_parse! closure macro variant in tests. (#1196) ([#1196](#1196))
- cssast/csskit_derives: Add new FeatureMetadata system (#1197) ([#1197](#1197))
- csskit_derives/css_ast: make derive(IntoCursor) work with generics (#1200) ([#1200](#1200))
- css_ast: Implement a NonEmpty generic (#1202) ([#1202](#1202))

### Css_lexer
- fuzz: early return atom functions when given non-atom tokens (#1206) ([#1206](#1206))
- fuzz(css_lexer): ensure REPLACEMENT_CHARACTER is appended in small idents (#1213) ([#1213](#1213))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))
- Impl Display for Comparison (#1193) ([#1193](#1193))
- css_parse: Improve assert_parse! macros to use a block/closure (#1194) ([#1194](#1194))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_derives
- csskit_derives: Ensure generics expect Peek when using it. (#1198) ([#1198](#1198))

### Csskit_source_finder
- csskit_source_finder: Don't find visitable nodes that just visit children (#1199) ([#1199](#1199))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))
- fix(deps): update dependency esbuild to v0.28.1 [security] (#1210) ([#1210](#1210))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 13, 2026
@keithamus
Canary Release
5a71ab4 
## [0.0.25] - 2026-06-13

### Other Changes
- Update cargo deps (#1189) ([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191) ([#1191](#1191))
- Fuzz: Try setting up a fuzzing suite (#1201) ([#1201](#1201))

### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183) ([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184) ([#1184](#1184))
- css_ast: Use assert_parse! closure macro variant in tests. (#1196) ([#1196](#1196))
- cssast/csskit_derives: Add new FeatureMetadata system (#1197) ([#1197](#1197))
- csskit_derives/css_ast: make derive(IntoCursor) work with generics (#1200) ([#1200](#1200))
- css_ast: Implement a NonEmpty generic (#1202) ([#1202](#1202))

### Css_lexer
- fuzz: early return atom functions when given non-atom tokens (#1206) ([#1206](#1206))
- fuzz(css_lexer): ensure REPLACEMENT_CHARACTER is appended in small idents (#1213) ([#1213](#1213))

### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer (#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190) ([#1190](#1190))
- Impl Display for Comparison (#1193) ([#1193](#1193))
- css_parse: Improve assert_parse! macros to use a block/closure (#1194) ([#1194](#1194))

### Csskit
- csskit: improve json output for subcommands (#1182) ([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185) ([#1185](#1185))

### Csskit_derives
- csskit_derives: Ensure generics expect Peek when using it. (#1198) ([#1198](#1198))

### Csskit_source_finder
- csskit_source_finder: Don't find visitable nodes that just visit children (#1199) ([#1199](#1199))

### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192) ([#1192](#1192))
- fix(deps): update dependency esbuild to v0.28.1 [security] (#1210) ([#1210](#1210))
keithamus added a commit that referenced this pull request Jun 13, 2026
@keithamus
Release v0.0.25 (#1181)
a8567c2 
## [0.0.25] - 2026-06-13

### Other Changes
- Update cargo deps (#1189)
([#1189](#1189))
- Push allocator-api2 back to 2.21 due to bumpalo (#1191)
([#1191](#1191))
- Fuzz: Try setting up a fuzzing suite (#1201)
([#1201](#1201))


### Css_ast
- css_ast: Avoid hanging on `={-->}` input. (#1183)
([#1183](#1183))
- Regenerate css_ast/src/values from csswg drafts (#1184)
([#1184](#1184))
- css_ast: Use assert_parse! closure macro variant in tests. (#1196)
([#1196](#1196))
- cssast/csskit_derives: Add new FeatureMetadata system (#1197)
([#1197](#1197))
- csskit_derives/css_ast: make derive(IntoCursor) work with generics
(#1200) ([#1200](#1200))
- css_ast: Implement a NonEmpty generic (#1202)
([#1202](#1202))


### Css_lexer
- fuzz: early return atom functions when given non-atom tokens (#1206)
([#1206](#1206))
- fuzz(css_lexer): ensure REPLACEMENT_CHARACTER is appended in small
idents (#1213) ([#1213](#1213))


### Css_parse
- css_parse: Ensure buffer is refilled if skipping past a whole buffer
(#1180) ([#1180](#1180))
- css_parse: Impl ToSpan for Comparison (#1190)
([#1190](#1190))
- Impl Display for Comparison (#1193)
([#1193](#1193))
- css_parse: Improve assert_parse! macros to use a block/closure (#1194)
([#1194](#1194))


### Csskit
- csskit: improve json output for subcommands (#1182)
([#1182](#1182))
- chore(deps): update dependencies (patch) (#1185)
([#1185](#1185))


### Csskit_derives
- csskit_derives: Ensure generics expect Peek when using it. (#1198)
([#1198](#1198))


### Csskit_source_finder
- csskit_source_finder: Don't find visitable nodes that just visit
children (#1199) ([#1199](#1199))


### Csskit_vscode
- chore(deps): update dependency @vscode/test-electron to v3 (#1192)
([#1192](#1192))
- fix(deps): update dependency esbuild to v0.28.1 [security] (#1210)
([#1210](#1210))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@keithamus