Skip to content

fuzz(css_parse): consume Bad tokens as trivia in blocks. - #1228

Merged
keithamus merged 2 commits into
mainfrom
fuzz/findings-20260617-033341
Jun 19, 2026
Merged

fuzz(css_parse): consume Bad tokens as trivia in blocks.#1228
keithamus merged 2 commits into
mainfrom
fuzz/findings-20260617-033341

Conversation

@keithamus

@keithamus keithamus commented Jun 17, 2026

Copy link
Copy Markdown
Member

Nightly fuzz run found new findings.

Another infinite loop can occur when a Bad token such as a BadUrl or BadString are tokenised inside of a block.

This adds these to the ERROR_KINDS, so they're consumed as trivia.

GHA run: https://github.com/csskit/csskit/actions/runs/27662846618

Findings

minimized-from-722d0b03d3ca5b333c03aea25e62b1387269e6d5 (24 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 0000 3a22 003b  alm:s {. ...:".;
00000010: 207d 0a0a 2d6d 3966                       }..-m9f
alm:s {
 ^V^@^@:"^@; }

-m9f

minimized-from-76568139280f4aefa0b422cb367267f4e1576624 (25 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 0000 003a 2200  alm:s {. ....:".
00000010: 3b20 7d0a 0a2d 6d39 66                   ; }..-m9f
alm:s {
 ^V^@^@^@:"^@; }

-m9f

minimized-from-bf9a2d055319a385b79d057b52d54b2a66053b07 (35 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 0000 0000 0000  alm:s {. .......
00000010: 003a 2200 0000 3b20 7d0a 0a2d 6669 732c  .:"...; }..-fis,
00000020: 6d39 66                                  m9f
alm:s {
 ^V^@^@^@^@^@^@^@:"^@^@^@; }

-fis,m9f

minimized-from-f93a5327abd07146473ec40c854733f17056d58d (18 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 0000 3a22 3b20  alm:s {. ...:"; 
00000010: 7d0a                                     }.
alm:s {
 ^V^@^@:"; }

minimized-from-22b028fa45b82983fcae1f9515dee73f7f7a9516 (130 bytes)

00000000: 7273 0a20 202a 2f0a 2020 2e70 616c 6d2d  rs.  */.  .palm-
00000010: 6f6e 652d 7175 6172 7465 722c 202e 7061  one-quarter, .pa
00000020: 6c6d 2d74 776f 2d65 6967 6874 6873 2c20  lm-two-eighths, 
00000030: 2e70 616c 6d2d 7468 7265 652d 7477 656c  .palm-three-twel
00000040: 6674 2020 3a73 207b 0a20 2020 2077 6964  ft  :s {.    wid
00000050: 7468 3a22 0000 003b 207d 0a0a 6f6c 6f72  th:"...; }..olor
00000060: 3a23 6520 202e 7061 6c6d 2d74 6872 6565  :#e  .palm-three
00000070: 2d66 6966 7468 732c 202e 7064 6561 6c6d  -fifths, .pdealm
00000080: 3966                                     9f
rs
  */
  .palm-one-quarter, .palm-two-eighths, .palm-three-twelft  :s {
    width:"^@^@^@; }

olor:#e  .palm-three-fifths, .pdealm9f

minimized-from-4bc5428312735d4d76733c059b79b2bec2061df4 (80 bytes)

00000000: 616c 6d2d 7468 7265 652d 7477 656c 6674  alm-three-twelft
00000010: 2020 3a73 207b 0a20 2020 2077 6964 7468    :s {.    width
00000020: 3a22 0000 003b 207d 0a0a 6f6c 6f72 3a23  :"...; }..olor:#
00000030: 6520 202e 7061 6c6d 2d74 6872 6565 2d66  e  .palm-three-f
00000040: 6966 7468 732c 202e 7064 6561 6c6d 3966  ifths, .pdealm9f
alm-three-twelft  :s {
    width:"^@^@^@; }

olor:#e  .palm-three-fifths, .pdealm9f

minimized-from-cb3bc07fe7f92a806e7b32e39fc4f1a90d872ed0 (238 bytes)

00000000: 7273 0a20 202a 2f0a 2020 2e70 616c 6d2d  rs.  */.  .palm-
00000010: 6f6e 652d 7175 6172 7465 722c 202e 7061  one-quarter, .pa
00000020: 6c6d 2d74 776f 2d65 6967 6874 6873 2c20  lm-two-eighths, 
00000030: 2e70 616c 6d2d 7468 7265 652d 7477 656c  .palm-three-twel
00000040: 6674 6873 207b 0a20 2020 2077 6964 7468  fths {.    width
00000050: 3a20 3235 253b 207d 0a0a 2020 2e70 616c  : 25%; }..  .pal
00000060: 6d2d 7468 7265 652d 7175 6172 7465 7273  m-three-quarters
00000070: 2c20 2e70 616c 6d2d 7369 782d 6569 6768  , .palm-six-eigh
00000080: 7468 732c 202e 7061 6c6d 2d6e 696e 652d  ths, .palm-nine-
00000090: 7477 656c 6674 6873 207b 0a20 2020 2077  twelfths {.    w
000000a0: 6964 7468 3a20 3735 253b 207d 0a0a 2020  idth: 75%; }..  
000000b0: 3a73 207b 0a20 2020 2077 6964 7468 3a22  :s {.    width:"
000000c0: 0000 003b 207d 0a0a 6f6c 6f72 3a23 6520  ...; }..olor:#e 
000000d0: 202e 7061 6c6d 2d74 6872 6565 2d66 6966   .palm-three-fif
000000e0: 7468 732c 202e 7064 6561 6c6d 3966       ths, .pdealm9f
rs
  */
  .palm-one-quarter, .palm-two-eighths, .palm-three-twelfths {
    width: 25%; }

  .palm-three-quarters, .palm-six-eighths, .palm-nine-twelfths {
    width: 75%; }

  :s {
    width:"^@^@^@; }

olor:#e  .palm-three-fifths, .pdealm9f

minimized-from-abdf9f40e9b0955f150bbc07e38879ec5e92827c (53 bytes)

00000000: 616c 6d2d 7468 7265 6520 203a 7320 7b0a  alm-three  :s {.
00000010: 2020 2020 7769 6474 683a 2200 0000 3b20      width:"...; 
00000020: 7d0a 0a2d 6669 6674 6873 2c20 2e70 6465  }..-fifths, .pde
00000030: 616c 6d39 66                             alm9f
alm-three  :s {
    width:"^@^@^@; }

-fifths, .pdealm9f

minimized-from-0d8f9c6f76eb3fd058b426cec08585ed7996f7d4 (33 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 0000 0000 0000  alm:s {. .......
00000010: 003a 2200 3b20 7d0a 0a2d 6669 732c 6d39  .:".; }..-fis,m9
00000020: 66                                       f
alm:s {
 ^V^@^@^@^@^@^@^@:"^@; }

-fis,m9f

minimized-from-025ff4eac7784614504032d10a0c8571e305ef10 (7 bytes)

00000000: 616c 6d3a 7b22 0a                        alm:{".
alm:{"

minimized-from-e768db7d2b1a2ace23e7901d5da60555a438f4b1 (14 bytes)

00000000: 616c 6d3a 7b0a 2016 3a22 3b20 7d0a       alm:{. .:"; }.
alm:{
 ^V:"; }

minimized-from-6c19a5690d4eba74eba5d4739a54ef18bffbed54 (6 bytes)

00000000: 616d 3a7b 220a                           am:{".
am:{"

minimized-from-bd1630739812d266e8ffb103ae0066e4b21dad04 (8 bytes)

00000000: 616c 6d3a 7b22 3b0a                      alm:{";.
alm:{";

minimized-from-47daa8aa42bdf34e5438337f1200a8c2f188a245 (43 bytes)

00000000: 616c 6d2d 7468 7265 6520 203a 7320 7b0a  alm-three  :s {.
00000010: 2016 0000 0000 0000 003a 2200 0000 3b20   ........:"...; 
00000020: 7d0a 0a2d 6669 732c 6d39 66              }..-fis,m9f
alm-three  :s {
 ^V^@^@^@^@^@^@^@:"^@^@^@; }

-fis,m9f

minimized-from-7d1112b543e4cf1dce5e5d298083e2ebceb030b2 (4 bytes)

00000000: 3a7b 220a                                :{".
:{"

minimized-from-9ef3535d2b3f4458b1f80579df50eeeb373dbd4f (73 bytes)

00000000: 616c 6d2d 7468 7265 6520 203a 7320 7b0a  alm-three  :s {.
00000010: 2020 2020 7769 6474 683a 2200 0000 3b20      width:"...; 
00000020: 7d0a 0a6f 6c6f 723a 2365 2020 2e70 616c  }..olor:#e  .pal
00000030: 6d2d 7468 7265 652d 6669 6674 6873 2c20  m-three-fifths, 
00000040: 2e70 6465 616c 6d39 66                   .pdealm9f
alm-three  :s {
    width:"^@^@^@; }

olor:#e  .palm-three-fifths, .pdealm9f

minimized-from-d597269a07a4a724e5a7291fa3d1d911f9ccf108 (16 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 3a22 3b20 7d0a  alm:s {. .:"; }.
alm:s {
 ^V:"; }

minimized-from-ab19f0d4479e0056d6e4b196944bee357b52d57f (50 bytes)

00000000: 616c 6d2d 7468 7265 6520 203a 7320 7b0a  alm-three  :s {.
00000010: 2016 0000 0000 0000 003a 2200 0000 3b20   ........:"...; 
00000020: 7d0a 0a2d 6669 732c 202e 7064 6561 6c6d  }..-fis, .pdealm
00000030: 3966                                     9f
alm-three  :s {
 ^V^@^@^@^@^@^@^@:"^@^@^@; }

-fis, .pdealm9f

minimized-from-d8a4ddf84b89659d8f57569f5136f16ecbbcce13 (101 bytes)

00000000: 7273 0a6c 6d2d 7477 6f2d 6569 6768 7468  rs.lm-two-eighth
00000010: 732c 202e 7061 6c6d 2d74 6872 6565 2d74  s, .palm-three-t
00000020: 7765 6c66 7420 203a 7320 7b0a 2020 2020  welft  :s {.    
00000030: 7769 6474 683a 2200 0000 3b20 7d0a 0a6f  width:"...; }..o
00000040: 6c6f 723a 2365 2020 2e70 616c 6d2d 7468  lor:#e  .palm-th
00000050: 7265 652d 6669 6674 6873 2c20 2e70 6465  ree-fifths, .pde
00000060: 616c 6d39 66                             alm9f
rs
lm-two-eighths, .palm-three-twelft  :s {
    width:"^@^@^@; }

olor:#e  .palm-three-fifths, .pdealm9f

minimized-from-2511e0d41ed1464caa15d8afa504fc0dc6568eda (10 bytes)

00000000: 616c 6d3a 7b22 3b20 7d0a                 alm:{"; }.
alm:{"; }

minimized-from-f186181c923b9416f8fac4e0f9b713c797589564 (23 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 0000 3a22 3b20  alm:s {. ...:"; 
00000010: 7d0a 0a2d 6d39 66                        }..-m9f
alm:s {
 ^V^@^@:"; }

-m9f

minimized-from-7778fe947fb4c8d1be90de6dc91bfabd6e891a11 (29 bytes)

00000000: 616c 6d3a 7320 7b0a 2016 0000 0000 0000  alm:s {. .......
00000010: 003a 2200 3b20 7d0a 0a2d 6d39 66         .:".; }..-m9f
alm:s {
 ^V^@^@^@^@^@^@^@:"^@; }

-m9f
@keithamus keithamus changed the title fuzz: new parser findings 2026-06-17 Jun 18, 2026
@keithamus
keithamus force-pushed the fuzz/findings-20260617-033341 branch from 429068a to 5b72627 Compare June 18, 2026 18:18
@github-actions

Copy link
Copy Markdown

✅ CI passed

Job Result
Build & Test (win32-x64, win32-arm64, linux-x64, linux-arm64, darwin-x64, darwin-arm64) ✅ success
Build & Test (default features) ✅ success
Build & Test (nightly) ✅ success
Build each library ✅ success
Acceptance Tests ✅ success
Fuzz Corpus Replay ✅ success
1 similar comment
@github-actions

Copy link
Copy Markdown

✅ CI passed

Job Result
Build & Test (win32-x64, win32-arm64, linux-x64, linux-arm64, darwin-x64, darwin-arm64) ✅ success
Build & Test (default features) ✅ success
Build & Test (nightly) ✅ success
Build each library ✅ success
Acceptance Tests ✅ success
Fuzz Corpus Replay ✅ success
@keithamus
keithamus merged commit aab0bd2 into main Jun 19, 2026
18 checks passed
@keithamus
keithamus deleted the fuzz/findings-20260617-033341 branch June 19, 2026 08:51
github-actions Bot pushed a commit that referenced this pull request Jun 19, 2026
## [0.0.26] - 2026-06-19

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))

[forcebuild]
@keithamus keithamus mentioned this pull request Jun 19, 2026
github-actions Bot pushed a commit that referenced this pull request Jun 19, 2026
## [0.0.26] - 2026-06-19

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot pushed a commit that referenced this pull request Jun 19, 2026
## [0.0.26] - 2026-06-19

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 19, 2026
## [0.0.26] - 2026-06-19

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot pushed a commit that referenced this pull request Jun 19, 2026
## [0.0.26] - 2026-06-19

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 19, 2026
## [0.0.26] - 2026-06-19

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
github-actions Bot pushed a commit that referenced this pull request Jun 20, 2026
## [0.0.26] - 2026-06-20

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
- csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235))
- csskit(node): Move build script to Mise (#1237) ([#1237](#1237))

[forcebuild]
github-actions Bot pushed a commit that referenced this pull request Jun 20, 2026
## [0.0.26] - 2026-06-20

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

### Csskit
- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
- csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235))
- csskit(node): Move build script to Mise (#1237) ([#1237](#1237))
keithamus added a commit that referenced this pull request Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
- csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235))
- csskit(node): Move build script to Mise (#1237) ([#1237](#1237))

[forcebuild]
keithamus added a commit that referenced this pull request Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
- csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235))
- csskit(node): Move build script to Mise (#1237) ([#1237](#1237))

[forcebuild]
keithamus added a commit that referenced this pull request Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227))

- Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225))

- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220))

- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228))

- chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
- csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235))
- csskit(node): Move build script to Mise (#1237) ([#1237](#1237))

[forcebuild]
keithamus added a commit that referenced this pull request Jun 20, 2026
## [0.0.26] - 2026-06-20

### Other Changes
- Chore(deps): update dependencies to v1.48.0 (#1227)
([#1227](#1227))


### Css_ast
- Regenerate css_ast/src/values from csswg drafts (#1221)
([#1221](#1221))
- fuzz(css_parse): Mark more erroneous tokens in blocks as trivia.
(#1225) ([#1225](#1225))


### Css_lexer
- fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220)
([#1220](#1220))


### Css_parse
- fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228)
([#1228](#1228))


### Csskit
- chore(deps): update dependencies (patch) (#1222)
([#1222](#1222))
- csskit_wasm/csskit(node): Provide csskit library functions in csskit
package (#1234) ([#1234](#1234))
- csskit(node): manage wasm-opt with mise (#1235)
([#1235](#1235))
- csskit(node): Move build script to Mise (#1237)
([#1237](#1237))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant