RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 11:58:12 +00:00
Code Issues Activity Actions

LibWeb: Check for invalid SVG viewBox sizes

Browse source 
Fixes #21825
This commit is contained in:
MacDue 2023-11-11 21:11:27 +00:00 • committed by Andreas Kling
parent cdfe893717
commit f57b3423eb
3 changed files with 34 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Userland/Libraries/LibWeb/Layout/SVGFormattingContext.cpp
View file

@ -188,11 +188,24 @@ void SVGFormattingContext::run(Box const& box, LayoutMode layout_mode, Available
box.for_each_in_subtree([&](Node const& descendant) {
if (is<SVGGraphicsBox>(descendant)) {
auto const& graphics_box = static_cast<SVGGraphicsBox const&>(descendant);
auto& graphics_box_state = m_state.get_mutable(graphics_box);
auto& dom_node = const_cast<SVGGraphicsBox&>(graphics_box).dom_node();
auto viewbox = dom_node.view_box();
// https://svgwg.org/svg2-draft/coords.html#ViewBoxAttribute
if (viewbox.has_value()) {
if (viewbox->width < 0 || viewbox->height < 0) {
// A negative value for <width> or <height> is an error and invalidates the ‘viewBox’ attribute.
viewbox = {};
} else if (viewbox->width == 0 || viewbox->height == 0) {
// A value of zero disables rendering of the element.
return IterationDecision::Continue;
}
}
auto& graphics_box_state = m_state.get_mutable(graphics_box);
auto svg_transform = dom_node.get_transform();
Gfx::AffineTransform viewbox_transform = compute_viewbox_transform(dom_node.view_box());
Gfx::AffineTransform viewbox_transform = compute_viewbox_transform(viewbox);
graphics_box_state.set_computed_svg_transforms(Painting::SVGGraphicsPaintable::ComputedTransforms(viewbox_transform, svg_transform));
auto to_css_pixels_transform = Gfx::AffineTransform {}.multiply(viewbox_transform).multiply(svg_transform);