CSSParserString::equalIgnoringCase should check string length.

Source/core/css/CSSParserValues.h

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 80 matching lines @@
     UChar operator[](unsigned i) const
     {
         ASSERT_WITH_SECURITY_IMPLICATION(i < m_length);
         if (is8Bit())
             return m_data.characters8[i];
         return m_data.characters16[i];
     }
 
     bool equalIgnoringCase(const char* str) const
     {
-        if (is8Bit())
-            return WTF::equalIgnoringCase(str, characters8(), length());
-        return WTF::equalIgnoringCase(str, characters16(), length());
+        bool match = is8Bit() ? WTF::equalIgnoringCase(str, characters8(), length()) : WTF::equalIgnoringCase(str, characters16(), length());
+        return match && str[length()] == '\0';

[esprehn, 2014/03/07 07:05:53]

Can you add an ASSERT(strlen(str) < length()) here? The index into the string is
really scary looking.

[tasak, 2014/03/07 09:55:49]

Sure. I added ASSERT.

     }
 
     template <size_t strLength>
     bool startsWithIgnoringCase(const char (&str)[strLength]) const
     {
         return startsWithIgnoringCase(str, strLength - 1);
     }
 
     bool startsWithIgnoringCase(const char* str, size_t strLength) const
     {
@@ skipping 165 matching lines @@
 inline void CSSParserValue::setFromValueList(PassOwnPtr<CSSParserValueList> valueList)
 {
     id = CSSValueInvalid;
     this->valueList = valueList.leakPtr();
     unit = ValueList;
 }
 
 }
 
 #endif