fuzz(css_parse): consume Bad tokens as trivia in blocks. - #1228
Merged
Conversation
keithamus
force-pushed
the
fuzz/findings-20260617-033341
branch
from
June 18, 2026 18:18
429068a to
5b72627
Compare
✅ CI passed
|
1 similar comment
✅ CI passed
|
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) [forcebuild]
Merged
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 20, 2026
## [0.0.26] - 2026-06-20 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 20, 2026
## [0.0.26] - 2026-06-20 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237))
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
## [0.0.26] - 2026-06-20 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nightly fuzz run found new findings.
Another infinite loop can occur when a Bad token such as a BadUrl or BadString are tokenised inside of a block.
This adds these to the ERROR_KINDS, so they're consumed as trivia.
GHA run: https://github.com/csskit/csskit/actions/runs/27662846618
Findings
minimized-from-722d0b03d3ca5b333c03aea25e62b1387269e6d5(24 bytes)minimized-from-76568139280f4aefa0b422cb367267f4e1576624(25 bytes)minimized-from-bf9a2d055319a385b79d057b52d54b2a66053b07(35 bytes)minimized-from-f93a5327abd07146473ec40c854733f17056d58d(18 bytes)minimized-from-22b028fa45b82983fcae1f9515dee73f7f7a9516(130 bytes)minimized-from-4bc5428312735d4d76733c059b79b2bec2061df4(80 bytes)minimized-from-cb3bc07fe7f92a806e7b32e39fc4f1a90d872ed0(238 bytes)minimized-from-abdf9f40e9b0955f150bbc07e38879ec5e92827c(53 bytes)minimized-from-0d8f9c6f76eb3fd058b426cec08585ed7996f7d4(33 bytes)minimized-from-025ff4eac7784614504032d10a0c8571e305ef10(7 bytes)minimized-from-e768db7d2b1a2ace23e7901d5da60555a438f4b1(14 bytes)minimized-from-6c19a5690d4eba74eba5d4739a54ef18bffbed54(6 bytes)minimized-from-bd1630739812d266e8ffb103ae0066e4b21dad04(8 bytes)minimized-from-47daa8aa42bdf34e5438337f1200a8c2f188a245(43 bytes)minimized-from-7d1112b543e4cf1dce5e5d298083e2ebceb030b2(4 bytes):{"minimized-from-9ef3535d2b3f4458b1f80579df50eeeb373dbd4f(73 bytes)minimized-from-d597269a07a4a724e5a7291fa3d1d911f9ccf108(16 bytes)minimized-from-ab19f0d4479e0056d6e4b196944bee357b52d57f(50 bytes)minimized-from-d8a4ddf84b89659d8f57569f5136f16ecbbcce13(101 bytes)minimized-from-2511e0d41ed1464caa15d8afa504fc0dc6568eda(10 bytes)minimized-from-f186181c923b9416f8fac4e0f9b713c797589564(23 bytes)minimized-from-7778fe947fb4c8d1be90de6dc91bfabd6e891a11(29 bytes)