浏览代码

LibWeb: Don't crash when parsing large floating point number values

Previously, attempting to parse a floating point number with an integer
part larger than `(2 ^ 31) - 1` would cause the browser to crash. We now
avoid this by converting the integer part of the number to a `double`
rather than an `i32`.
Tim Ledbetter 9 月之前
父节点
当前提交
21a32e4b6d

+ 1 - 0
Tests/LibWeb/Text/expected/HTML/HTMLProgressElement-large-max-value.txt

@@ -0,0 +1 @@
+progressElement.max: 1e+21

+ 9 - 0
Tests/LibWeb/Text/input/HTML/HTMLProgressElement-large-max-value.html

@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<progress max="1000000000000000000000"></progress>
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        const progressElement = document.querySelector("progress");
+        println(`progressElement.max: ${progressElement.max}`);
+    });
+</script>

+ 1 - 1
Userland/Libraries/LibWeb/HTML/Numbers.cpp

@@ -150,7 +150,7 @@ Optional<double> parse_floating_point_number(StringView string)
         lexer.consume_while(is_ascii_digit);
         size_t end_index = lexer.tell();
         auto digits = lexer.input().substring_view(start_index, end_index - start_index);
-        auto optional_value = AK::StringUtils::convert_to_int<i32>(digits);
+        auto optional_value = AK::StringUtils::convert_to_floating_point<double>(digits, TrimWhitespace::No);
         value *= optional_value.value();
     }