mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-07 16:49:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Clamp paintable box maximum scroll offset to 0

Browse source 
Previously calling `PaintableBox::set_scroll_offset()` with a
PaintableBox whose content size was larger than its scrollble overflow
rect would cause a crash.

Found by Domato.
This commit is contained in:
Tim Ledbetter 2024-07-21 17:18:47 +01:00 • committed by Andreas Kling
commit 604f6040a1
Notes: github-actions[bot] 2024-07-22 07:14:27 +00:00
3 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/Element-scrollby-negative-scroll-offset-crash.txt Normal file
View file

@ -0,0 +1 @@
PASS (didn't crash)

16
Tests/LibWeb/Text/input/Element-scrollby-negative-scroll-offset-crash.html Normal file
View file

@ -0,0 +1,16 @@
<!DOCTYPE html>
<style>
#test {
height: 0;
}
</style>
<script src="include.js"></script>
<div id="test">test</div>
<script>
test(() => {
const divElement = document.getElementById("test");
divElement.scrollBy(1, 1);
divElement.remove();
println("PASS (didn't crash)");
});
</script>

5
Userland/Libraries/LibWeb/Painting/PaintableBox.cpp
View file

@ -82,8 +82,9 @@ void PaintableBox::set_scroll_offset(CSSPixelPoint offset)
document().set_needs_to_refresh_clip_state(true); document().set_needs_to_refresh_clip_state(true);
document().set_needs_to_refresh_scroll_state(true); document().set_needs_to_refresh_scroll_state(true);
auto max_x_offset = scrollable_overflow_rect->width() - content_size().width(); auto max_x_offset = max(scrollable_overflow_rect->width() - content_size().width(), 0);
auto max_y_offset = scrollable_overflow_rect->height() - content_size().height(); auto max_y_offset = max(scrollable_overflow_rect->height() - content_size().height(), 0);
offset.set_x(clamp(offset.x(), 0, max_x_offset)); offset.set_x(clamp(offset.x(), 0, max_x_offset));
offset.set_y(clamp(offset.y(), 0, max_y_offset)); offset.set_y(clamp(offset.y(), 0, max_y_offset));