diff --git a/Tests/LibWeb/Text/expected/HTML/maxed-out-dimension-value.txt b/Tests/LibWeb/Text/expected/HTML/maxed-out-dimension-value.txt new file mode 100644 index 00000000000..c5da913f2cf --- /dev/null +++ b/Tests/LibWeb/Text/expected/HTML/maxed-out-dimension-value.txt @@ -0,0 +1 @@ + Image height: 17895700 diff --git a/Tests/LibWeb/Text/input/HTML/maxed-out-dimension-value.html b/Tests/LibWeb/Text/input/HTML/maxed-out-dimension-value.html new file mode 100644 index 00000000000..9a5709f3277 --- /dev/null +++ b/Tests/LibWeb/Text/input/HTML/maxed-out-dimension-value.html @@ -0,0 +1,9 @@ + + + diff --git a/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp b/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp index 6de3d078f6d..b52088e3edb 100644 --- a/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp +++ b/Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp @@ -4691,13 +4691,16 @@ RefPtr parse_dimension_value(StringView string) number_string.append(*position); ++position; } - auto integer_value = number_string.string_view().to_number(); + auto integer_value = number_string.string_view().to_number(); + + // NOTE: This is apparently the largest value allowed by Firefox. + static float max_dimension_value = 17895700; + + float value = min(*integer_value, max_dimension_value); // 6. If position is past the end of input, then return value as a length. if (position == input.end()) - return CSS::LengthStyleValue::create(CSS::Length::make_px(*integer_value)); - - float value = *integer_value; + return CSS::LengthStyleValue::create(CSS::Length::make_px(CSSPixels(value))); // 7. If the code point at position within input is U+002E (.), then: if (*position == '.') {