RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 20:28:11 +00:00
Code Issues Activity Actions

LibWeb: Fix null dereference on SVG element with bogus fill URL

Browse source 
Fixes a crash seen on YouTube channel pages.
This commit is contained in:
Andreas Kling 2023-05-19 15:14:34 +02:00
parent 411b28fc59
commit 6f204f8c32
3 changed files with 15 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Userland/Libraries/LibWeb/SVG/SVGGraphicsElement.cpp
View file

@ -51,11 +51,11 @@ Optional<Gfx::PaintStyle const&> SVGGraphicsElement::fill_paint_style(SVGPaintCo
if (!fill.has_value() || !fill->is_url())
return {};
auto& url = fill->as_url();
auto maybe_gradient = document().get_element_by_id(url.fragment());
if (is<SVG::SVGGradientElement>(*maybe_gradient)) {
auto& gradient = verify_cast<SVG::SVGGradientElement>(*maybe_gradient);
return gradient.to_gfx_paint_style(paint_context);
}
auto gradient = document().get_element_by_id(url.fragment());
if (!gradient)
return {};
if (is<SVG::SVGGradientElement>(*gradient))
return static_cast<SVG::SVGGradientElement const&>(*gradient).to_gfx_paint_style(paint_context);
return {};
}