beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-22 15:40:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

LibWeb: Do not crash inside SVGDecodedImageData on invalid SVG input

Browse source 
Return error when input svg is not valid and SVGSVGElement is not
present in the tree instead of doing svg_root nullptr dereference.

Fixes crash on https://apps.kde.org/en-gb/
This commit is contained in:
Aliaksandr Kalenik 2023-06-21 19:17:15 +03:00 committed by Andreas Kling
parent 33dbfa3281
commit 8c980cf75b
Notes: sideshowbarker 2024-07-17 01:46:00 +09:00 
Author: https://github.com/kalenikaliaksandr
Commit: https://github.com/SerenityOS/serenity/commit/8c980cf75b
Pull-request: https://github.com/SerenityOS/serenity/pull/19538
3 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Tests/LibWeb/Layout/expected/svg/svg-as-image-invalid.txt Normal file
View file

@ -0,0 +1,4 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x48 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x32 children: not-inline
ImageBox <img> at (8,8) content-size 16x32 children: not-inline

1
Tests/LibWeb/Layout/input/svg/svg-as-image-invalid.html Normal file
View file

@ -0,0 +1 @@
<!doctype html><img src="data:image/svg+xml;,some-garbage" style="display: block">

3
Userland/Libraries/LibWeb/SVG/SVGDecodedImageData.cpp
View file

@ -70,6 +70,9 @@ ErrorOr<NonnullRefPtr<SVGDecodedImageData>> SVGDecodedImageData::create(Page& ho
// Perform some DOM surgery to make the SVG root element be the first child of the Document.
// FIXME: This is a huge hack until we figure out how to actually parse separate SVG files.
auto* svg_root = document->body()->first_child_of_type<SVG::SVGSVGElement>();
if (!svg_root)
return Error::from_string_literal("SVGDecodedImageData: Invalid SVG input");
svg_root->remove();
document->remove_all_children();