RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-06-01 02:38:13 +00:00
Code Issues Activity Actions

LibWeb: Fix vector OOB access when comparing some calc() values

Browse source 
Before comparing the elements of two vectors, we have to check that
they have the same length. :^)

Fixes a crash seen on https://chat.openai.com/
This commit is contained in:
Andreas Kling 2024-01-27 16:13:47 +01:00
parent 9272d185ad
commit 546143e9a6
3 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
Tests/LibWeb/Text/input/css/replace-calc-function-with-same-kind-but-fewer-arguments.html Normal file
View file

@ -0,0 +1,13 @@
<!doctype html><script src="../include.js"></script><body><script>
test(() => {
let body = document.body;
body.style.width = 'max(10px, 20px, 30px)';
body.style.width = 'max(10px, 20px)';
body.style.width = 'min(10px, 20px, 30px)';
body.style.width = 'min(10px, 20px)';
body.style.width = 'calc(10px + 20px + 30px)';
body.style.width = 'calc(10px + 20px)';
body.style.width = 'calc(10px * 20px * 30px)';
body.style.width = 'calc(10px * 20px)';
});
</script>PASS! (didn't crash)