[Fix] Fix off-by-one error in css tokenizer

diff --git a/src/libserver/css/css_tokeniser.cxx b/src/libserver/css/css_tokeniser.cxx
index ace94cae2dfbb631aa27aa76b1a907871ec77573..f3c010f1e69e89bbf566cf5e2de414c8cfe661b2 100644 (file)
--- a/src/libserver/css/css_tokeniser.cxx
+++ b/src/libserver/css/css_tokeniser.cxx
@@ -557,7 +557,13 @@ auto css_tokeniser::next_token(void) -> struct css_parser_token
                case '"':
                case '\'':
                        offset = i + 1;
-                       return make_token<css_parser_token::token_type::string_token>(consume_string(c));
+                       if (offset < input.size()) {
+                               return make_token<css_parser_token::token_type::string_token>(consume_string(c));
+                       }
+                       else {
+                               /* Unpaired quote at the end of the rule */
+                               return make_token<css_parser_token::token_type::delim_token>(c);
+                       }
                case '(':
                        offset = i + 1;
                        return make_token<css_parser_token::token_type::obrace_token>();