[CSS] Accept 8 (#RRGGBBAA) and 4 (#RGBA) value hex colors

third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSPropertyParserHelpers.h"
 
 #include "core/css/CSSCalculationValue.h"
 #include "core/css/CSSStringValue.h"
 #include "core/css/CSSValuePair.h"
 // TODO(timloh): Remove this dependency
@@ skipping 398 matching lines @@
             && token.numericValue() >= 0. && token.numericValue() < 1000000.) { // e.g. 112233
             color = String::format("%06d", static_cast<int>(token.numericValue()));
         } else if (token.type() == DimensionToken) { // e.g. 0001FF
             // TODO(timloh): This should check the numericValueType flag
             color = String::number(static_cast<int>(token.numericValue())) + String(token.value());
             if (color.length() > 6)
                 return false;
             while (color.length() < 6)
                 color = "0" + color;
         } else if (token.type() == IdentToken) { // e.g. FF0000
+            unsigned length = token.value().length();
+            if (length != 3 && length != 6)
+                return false;
             color = token.value();
         }
     }
     if (token.type() == HashToken)
         color = token.value();
     if (!Color::parseHexColor(color, result))
         return false;
     range.consumeIncludingWhitespace();
     return true;
 }
@@ skipping 161 matching lines @@
     if (!value2) {
         positionFromOneValue(value1, resultX, resultY);
         return true;
     }
     return positionFromTwoValues(value1, value2, resultX, resultY);
 }
 
 } // namespace CSSPropertyParserHelpers
 
 } // namespace blink