0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibWeb: Avoid division by zero in SourceSet width descriptor calculation

Browse source
This commit is contained in:
Tim Ledbetter 2024-08-07 23:46:38 +01:00 • committed by Alexander Kalenik
parent aa32bfa448
commit 087d400472
Notes: github-actions[bot] 2024-08-08 10:20:52 +00:00
3 changed files with 24 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
Tests/LibWeb/Layout/expected/srcset-sizes-crash.txt Normal file
View file

@ -0,0 +1,14 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x600 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x17 children: inline
frag 0 from ImageBox start: 0, length: 0, rect: [8,20 1x1] baseline: 1
frag 1 from TextNode start: 0, length: 19, rect: [9,8 162.109375x17] baseline: 13.296875
"PASS (didn't crash)"
ImageBox <img> at (8,20) content-size 1x1 children: not-inline
TextNode <#text>
ViewportPaintable (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x600]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x17]
ImagePaintable (ImageBox<IMG>) [8,20 1x1]
TextPaintable (TextNode<#text>)

1
Tests/LibWeb/Layout/input/srcset-sizes-crash.html Normal file
View file

@ -0,0 +1 @@
<img sizes="0" srcset="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQIW2NgaGD4DwAChAGAZM0bBgAAAABJRU5ErkJggg== 100w"/>PASS (didn't crash)

16
Userland/Libraries/LibWeb/HTML/SourceSet.cpp
View file

@ -418,22 +418,24 @@ void SourceSet::normalize_source_densities(DOM::Element const& element)
// 2. Otherwise, if the image source has a width descriptor,
// replace the width descriptor with a pixel density descriptor
// with a value of the width descriptor value divided by the source size and a unit of x.
auto descriptor_value_set = false;
if (image_source.descriptor.has<ImageSource::WidthDescriptorValue>()) {
auto& width_descriptor = image_source.descriptor.get<ImageSource::WidthDescriptorValue>();
if (source_size.is_absolute()) {
image_source.descriptor = ImageSource::PixelDensityDescriptorValue {
.value = (width_descriptor.value / source_size.absolute_length_to_px()).to_double()
};
auto source_size_in_pixels = source_size.absolute_length_to_px();
if (source_size_in_pixels != 0) {
image_source.descriptor = ImageSource::PixelDensityDescriptorValue {
.value = (width_descriptor.value / source_size_in_pixels).to_double()
};
descriptor_value_set = true;
}
} else {
dbgln("FIXME: Image element has unresolved relative length '{}' in sizes attribute", source_size);
image_source.descriptor = ImageSource::PixelDensityDescriptorValue {
.value = 1,
};
}
}
// 3. Otherwise, give the image source a pixel density descriptor of 1x.
else {
if (!descriptor_value_set) {
image_source.descriptor = ImageSource::PixelDensityDescriptorValue {
.value = 1.0f
};