css_parser: check allocation errors

This is not exploitable because it's allocation of (small) hardcoded size. Or maybe with an infinite loop that allocates, but the problem is not the allocation...