Index: third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp |
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp |
index 0fe218a71e5f9fa77ac5318125288cde0d22eb9b..49b1abb42138a4ef1369528973876cc8971d16e8 100644 |
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp |
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp |
@@ -416,6 +416,9 @@ static bool parseHexColor(CSSParserTokenRange& range, RGBA32& result, bool accep |
while (color.length() < 6) |
color = "0" + color; |
} else if (token.type() == IdentToken) { // e.g. FF0000 |
+ unsigned length = token.value().length(); |
+ if (length != 3 && length != 6) |
+ return false; |
color = token.value(); |
} |
} |