LibWeb: Don't crash when parsing HTMLInputElement invalid time values

This commit is contained in:
Tim Ledbetter 2024-08-20 21:56:04 +01:00 committed by Tim Ledbetter
parent b0fc8b67d6
commit fe42e2719f
Notes: github-actions[bot] 2024-08-20 22:31:28 +00:00
3 changed files with 20 additions and 0 deletions

View file

@ -0,0 +1 @@
PASS (didn't crash)

View file

@ -0,0 +1,13 @@
<!DOCTYPE html>
<script src="../include.js"></script>
<script>
test(() => {
const inputElement = document.createElement("input");
inputElement.type = "time";
inputElement.value = "invalid";
inputElement.value = "xx:34:56";
inputElement.value = "12:xx:56";
inputElement.value = "12:34:xx";
println("PASS (didn't crash)");
});
</script>

View file

@ -183,11 +183,15 @@ bool is_valid_time_string(StringView value)
return false;
if (parts[0].length() != 2)
return false;
if (!(is_ascii_digit(parts[0][0]) && is_ascii_digit(parts[0][1])))
return false;
auto hour = (parse_ascii_digit(parts[0][0]) * 10) + parse_ascii_digit(parts[0][1]);
if (hour > 23)
return false;
if (parts[1].length() != 2)
return false;
if (!(is_ascii_digit(parts[1][0]) && is_ascii_digit(parts[1][1])))
return false;
auto minute = (parse_ascii_digit(parts[1][0]) * 10) + parse_ascii_digit(parts[1][1]);
if (minute > 59)
return false;
@ -196,6 +200,8 @@ bool is_valid_time_string(StringView value)
if (parts[2].length() < 2)
return false;
if (!(is_ascii_digit(parts[2][0]) && is_ascii_digit(parts[2][1])))
return false;
auto second = (parse_ascii_digit(parts[2][0]) * 10) + parse_ascii_digit(parts[2][1]);
if (second > 59)
return false;