SIGN IN SIGN UP
oven-sh / bun UNCLAIMED

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

0 0 150 Rust

css: don't panic on out-of-range @font-palette-values palette indices (#31275)

Fixes a panic found by CSS fuzzing.

### Repro

```sh
BUN_FEATURE_FLAG_INTERNAL_FOR_TESTING=1 bun -e 'require("bun:internal-for-testing").cssInternals.minifyTest("@font-palette-values --{base-palette:99999", "")'
```

```
panic: int cast: TryFromIntError(PosOverflow)
```

Any stylesheet containing `@font-palette-values` with an integer above
65535 hits it, e.g. `@font-palette-values --x { base-palette: 99999 }`,
so `Bun.build`/the CSS bundler can be crashed by plain CSS input.

### Cause

`BasePalette` and `OverrideColors` in
`src/css/rules/font_palette_values.rs` store the palette index as `u16`,
but parse it as a CSS `<integer>` (i32) and convert with
`u16::try_from(..).expect("int cast")`. Values that don't fit in `u16`
(negative values were already rejected) panic on the cast. The same cast
exists in both the `base-palette` and `override-colors` parsers.

### Fix

Treat out-of-range indices the same way negatives are already handled:
return `ParserError::invalid_value`, which makes the declaration fall
back to the unknown-property path and be preserved verbatim instead of
crashing:

```
@font-palette-values --x{base-palette:99999}  ->  @font-palette-values --x{base-palette:99999}
```

In-range values are unaffected.

### Verification

- New tests in `test/js/bun/css/css.test.ts` (`font-palette-values`
block) cover in-range values, out-of-range/negative `base-palette` and
`override-colors` indices, and the fuzzer-minimized unterminated input.
Without the fix they reproduce the panic; with the fix the whole file
passes (1058 pass / 0 fail).
- `cargo check -p bun_css` and `cargo clippy -p bun_css` are clean.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
R
robobun committed
543f2f9963664e16ae1880591dec7e2f1fdbd583
Parent: aff1bb1
Committed by GitHub <noreply@github.com> on 5/24/2026, 2:02:34 AM