Stricter parsing for span attribute on col element

Source/core/html/HTMLTableColElement.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 10 matching lines @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "config.h"
 #include "core/html/HTMLTableColElement.h"
 
 #include "core/CSSPropertyNames.h"
 #include "core/HTMLNames.h"
 #include "core/html/HTMLTableElement.h"
+#include "core/html/parser/HTMLParserIdioms.h"
 #include "core/rendering/RenderTableCol.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 inline HTMLTableColElement::HTMLTableColElement(const QualifiedName& tagName, Document& document)
     : HTMLTablePartElement(tagName, document)
     , m_span(1)
 {
@@ skipping 12 matching lines @@
 {
     if (name == widthAttr)
         addHTMLLengthToStyle(style, CSSPropertyWidth, value);
     else
         HTMLTablePartElement::collectStyleForPresentationAttribute(name, value, style);
 }
 
 void HTMLTableColElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == spanAttr) {
-        int newSpan = value.toInt();
-        // If the value of span is not a valid non-negative integer greater than zero,
-        // set it to 1.
-        m_span = newSpan ? newSpan : 1;
+        int newSpan = 0;
+        if (value.isEmpty() || !parseHTMLInteger(value, newSpan) || newSpan < 1) {
+            // If the value of span is not a valid non-negative integer greater than zero,
+            // set it to 1.
+            newSpan = 1;
+        }
+        m_span = newSpan;
         if (renderer() && renderer()->isRenderTableCol())
             renderer()->updateFromElement();
     } else if (name == widthAttr) {
         if (!value.isEmpty()) {
             if (renderer() && renderer()->isRenderTableCol()) {
                 RenderTableCol* col = toRenderTableCol(renderer());
                 int newWidth = width().toInt();
                 if (newWidth != col->size().width())
                     col->setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation();
             }
@@ skipping 15 matching lines @@
 {
     setIntegralAttribute(spanAttr, n);
 }
 
 const AtomicString& HTMLTableColElement::width() const
 {
     return getAttribute(widthAttr);
 }
 
 }