0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions2

LibWeb: Fix OOB access in "text-overflow: ellipsis" clip

Browse source 
Fixes out of bound access to glyph run when `last_glyph_index` is 0.

Fixes crashing on https://github.com/LadybirdBrowser/ladybird/pulls
This commit is contained in:
Aliaksandr Kalenik 2024-08-03 18:18:44 +03:00 • committed by Andreas Kling
parent c0f30f31d1
commit fa605ef225
Notes: github-actions[bot] 2024-08-03 17:46:29 +00:00
2 changed files with 9 additions and 5 deletions
Tests/LibWeb/Ref
text-overflow.html
Userland/Libraries/LibWeb/Layout
InlineFormattingContext.cpp

1
Tests/LibWeb/Ref/text-overflow.html
View file

@ -15,3 +15,4 @@
</style>
<div class="clip">This text gets clipped</div>
<div class="ellipsis">This text gets an ellipsis</div>
<div class="ellipsis" style="width: 0px">Invisible</div>

13
Userland/Libraries/LibWeb/Layout/InlineFormattingContext.cpp
View file

@ -351,7 +351,7 @@ void InlineFormattingContext::generate_line_boxes(LayoutMode layout_mode)
auto max_text_width = available_width - ellipsis_width;
auto& glyphs = glyph_run->glyphs();
auto last_glyph_index = 0;
size_t last_glyph_index = 0;
auto last_glyph_position = Gfx::FloatPoint();
for (auto const& glyph_or_emoji : glyphs) {
@ -370,10 +370,13 @@ void InlineFormattingContext::generate_line_boxes(LayoutMode layout_mode)
last_glyph_position = this_position;
}
auto remove_item_count = glyphs.size() - last_glyph_index;
glyphs.remove(last_glyph_index - 1, remove_item_count);
glyphs.append(Gfx::DrawGlyph(last_glyph_position, ellipsis_codepoint));
if (last_glyph_index > 1) {
auto remove_item_count = glyphs.size() - last_glyph_index;
glyphs.remove(last_glyph_index - 1, remove_item_count);
glyphs.append(Gfx::DrawGlyph {
.position = last_glyph_position,
.code_point = ellipsis_codepoint });
}
}
}
line_builder.append_text_chunk(