From 1bc74dac2b251764d373c164e2b5235875f27901 Mon Sep 17 00:00:00 2001
From: Tor Andersson <tor.andersson@artifex.com>
Date: Tue, 14 Apr 2015 10:55:35 +0200
Subject: epub: Parse url() tokens.

Fix bug 695922.
---
 source/html/css-parse.c | 43 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

(limited to 'source')

diff --git a/source/html/css-parse.c b/source/html/css-parse.c
index 91958a98..ff364fc7 100644
--- a/source/html/css-parse.c
+++ b/source/html/css-parse.c
@@ -311,6 +311,38 @@ static int css_lex_string(struct lexbuf *buf, int q)
 	return CSS_STRING;
 }
 
+static void css_lex_uri(struct lexbuf *buf)
+{
+	while (buf->c && buf->c != ')' && !iswhite(buf->c))
+	{
+		if (css_lex_accept(buf, '\\'))
+		{
+			if (css_lex_accept(buf, 'n'))
+				css_push_char(buf, '\n');
+			else if (css_lex_accept(buf, 'r'))
+				css_push_char(buf, '\r');
+			else if (css_lex_accept(buf, 'f'))
+				css_push_char(buf, '\f');
+			else
+			{
+				css_push_char(buf, buf->c);
+				css_lex_next(buf);
+			}
+		}
+		else if (buf->c == '!' || buf->c == '#' || buf->c == '$' || buf->c == '%' || buf->c == '&' ||
+				(buf->c >= '*' && buf->c <= '[') ||
+				(buf->c >= ']' && buf->c <= '~') ||
+				buf->c > 159)
+		{
+			css_push_char(buf, buf->c);
+			css_lex_next(buf);
+		}
+		else
+			fz_css_error(buf, "unexpected character in url");
+	}
+	css_push_char(buf, 0);
+}
+
 static int css_lex(struct lexbuf *buf)
 {
 	int t;
@@ -436,7 +468,16 @@ colorerror:
 				{
 					if (css_lex_accept(buf, '('))
 					{
-						// string or url
+						while (iswhite(buf->c))
+							css_lex_next(buf);
+						if (css_lex_accept(buf, '"'))
+							css_lex_string(buf, '"');
+						else if (css_lex_accept(buf, '\''))
+							css_lex_string(buf, '\'');
+						else
+							css_lex_uri(buf);
+						while (iswhite(buf->c))
+							css_lex_next(buf);
 						css_lex_expect(buf, ')');
 						return CSS_URI;
 					}
-- 
cgit v1.2.3