RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 21:57:35 +00:00
Code Issues Activity Actions

LibWeb: Consume sign in SVG::parse_elliptical_arg_argument

Browse source 
This was crashing on google.com with the linux chrome user agent,
interestingly it seems like this behavior may have been accidental as
only two of the three `parse_number()` were changed in f7dbcb6
This commit is contained in:
Cameron Youell 2023-05-26 21:53:13 +10:00 • committed by Andreas Kling
parent 5cec517153
commit 0afdde0eef
3 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Tests/LibWeb/Layout/expected/svg/svg-negative-elliptical-arg-number.txt Normal file
View file

@ -0,0 +1,7 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x116 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x100 children: inline
line 0 width: 100, height: 100, bottom: 100, baseline: 48
frag 0 from SVGSVGBox start: 0, length: 0, rect: [8,8 100x100]
SVGSVGBox <svg> at (8,8) content-size 100x100 [SVG] children: not-inline
SVGGeometryBox <path> at (8,9.999999) content-size 100x48 children: not-inline

5
Tests/LibWeb/Layout/input/svg/svg-negative-elliptical-arg-number.html Normal file
View file

@ -0,0 +1,5 @@
<!DOCTYPE html><html><body><svg
xmlns="http://www.w3.org/2000/svg"
width="100"
height="100"
viewBox="0 0 10 10"><path d="M0,5 10,5 5.5,.5 a 1,-1 0 0 0 -.5,-.3 1,-1 0 0 0 -.5, .2">

4
Userland/Libraries/LibWeb/SVG/AttributeParser.cpp
View file

@ -343,10 +343,10 @@ Vector<float> AttributeParser::parse_coordinate_pair_triplet()
Vector<float> AttributeParser::parse_elliptical_arg_argument()
{
Vector<float> numbers;
numbers.append(parse_nonnegative_number());
numbers.append(parse_number());
if (match_comma_whitespace())
parse_comma_whitespace();
numbers.append(parse_nonnegative_number());
numbers.append(parse_number());
if (match_comma_whitespace())
parse_comma_whitespace();
numbers.append(parse_number());