Stricter parsing for rowSpan/ColSpan on th/td element

Source/core/html/HTMLTableCellElement.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 13 matching lines @@
 
 #include "config.h"
 #include "core/html/HTMLTableCellElement.h"
 
 #include "core/CSSPropertyNames.h"
 #include "core/CSSValueKeywords.h"
 #include "core/HTMLNames.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/html/HTMLTableElement.h"
+#include "core/html/parser/HTMLParserIdioms.h"
 #include "core/rendering/RenderTableCell.h"
 
 using std::max;
 using std::min;
 
 namespace blink {
 
 // Clamp rowspan and colspan at 8k.
 // Firefox used a limit of 8190 for rowspan but they changed it to 65,534.
 // (FIXME: We should consider increasing this limit (crbug.com/78577).
 // Firefox uses a limit of 1,000 for colspan and resets the value to 1
 // but we don't discriminate between rowspan / colspan as it is artificial.
 static const int maxColRowSpan = 8190;
 
 using namespace HTMLNames;
 
 inline HTMLTableCellElement::HTMLTableCellElement(const QualifiedName& tagName, Document& document)
     : HTMLTablePartElement(tagName, document)
 {
 }
 
 DEFINE_ELEMENT_FACTORY_WITH_TAGNAME(HTMLTableCellElement)
 
 int HTMLTableCellElement::colSpan() const
 {
     const AtomicString& colSpanValue = fastGetAttribute(colspanAttr);
-    return max(1, min(colSpanValue.toInt(), maxColRowSpan));
+    int value = 0;
+    if (colSpanValue.isEmpty() || !parseHTMLInteger(colSpanValue, value))
+        return 1;
+    return max(1, min(value, maxColRowSpan));
 }
 
 int HTMLTableCellElement::rowSpan() const
 {
     const AtomicString& rowSpanValue = fastGetAttribute(rowspanAttr);
-    return max(1, min(rowSpanValue.toInt(), maxColRowSpan));
+    int value = 0;
+    if (rowSpanValue.isEmpty() || !parseHTMLInteger(rowSpanValue, value))
+        return 1;
+    return max(1, min(value, maxColRowSpan));
 }
 
 int HTMLTableCellElement::cellIndex() const
 {
     if (!isHTMLTableRowElement(parentElement()))
         return -1;
 
     int index = 0;
     for (const HTMLTableCellElement* element = Traversal<HTMLTableCellElement>::previousSibling(*this); element; element = Traversal<HTMLTableCellElement>::previousSibling(*element))
         ++index;
@@ skipping 102 matching lines @@
 
     RenderTableCell* tableCellRenderer = toRenderTableCell(cellRenderer);
     RenderTableCell* cellAboveRenderer = tableCellRenderer->table()->cellAbove(tableCellRenderer);
     if (!cellAboveRenderer)
         return nullptr;
 
     return toHTMLTableCellElement(cellAboveRenderer->node());
 }
 
 } // namespace blink