mirrors/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-04-21 20:15:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb: Fix infinite loop in CSS::Parser::parse_transition_value()

Browse source
This commit is contained in:
Matthew Olsson 2024-03-29 17:57:17 -07:00 • committed by Andreas Kling
parent 906c69c6d1
commit 87155c7b1d
Notes: sideshowbarker 2024-07-18 02:13:10 +09:00
3 changed files with 30 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/WebAnimations/transitions/parse-transition-property.txt Normal file
View file

@ -0,0 +1 @@
PASS! (Did not crash/timeout)

15
Tests/LibWeb/Text/input/WebAnimations/transitions/parse-transition-property.html Normal file
View file

@ -0,0 +1,15 @@
<!DOCTYPE html>
<style>
#foo {
transition: background-color 1s 2s linear,
opacity,
this is an invalid property value;
}
</style>
<div id="foo"></div>
<script src="../../include.js"></script>
<script>
test(() => {
println("PASS! (Did not crash/timeout)");
});
</script>

22
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
View file

@ -5367,6 +5367,16 @@ RefPtr<StyleValue> Parser::parse_transition_value(TokenStream<ComponentValue>& t
continue;
}
if (auto easing = parse_easing_value(tokens)) {
if (transition.easing) {
dbgln_if(CSS_PARSER_DEBUG, "Transition property has multiple easing values");
return {};
}
transition.easing = easing->as_easing();
continue;
}
if (tokens.peek_token().is(Token::Type::Ident)) {
if (transition.property_name) {
dbgln_if(CSS_PARSER_DEBUG, "Transition property has multiple property identifiers");
@ -5376,16 +5386,12 @@ RefPtr<StyleValue> Parser::parse_transition_value(TokenStream<ComponentValue>& t
auto ident = tokens.next_token().token().ident();
if (auto property = property_id_from_string(ident); property.has_value())
transition.property_name = CustomIdentStyleValue::create(ident);
continue;
}
if (auto easing = parse_easing_value(tokens)) {
if (transition.easing) {
dbgln_if(CSS_PARSER_DEBUG, "Transition property has multiple easing values");
return {};
}
transition.easing = easing->as_easing();
}
dbgln_if(CSS_PARSER_DEBUG, "Transition property has unexpected token \"{}\"", tokens.peek_token().to_string());
return {};
}
if (!transition.property_name)