From b8f78e3bc13b9c805353e3e34ff2e4865ea8ced4 Mon Sep 17 00:00:00 2001 From: Gingeh <39150378+Gingeh@users.noreply.github.com> Date: Tue, 1 Jul 2025 20:25:03 +1000 Subject: [PATCH] LibWeb: Don't crash with invalid transform-origin values --- Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp | 6 +++--- Tests/LibWeb/Text/expected/invalid-transform-origin.txt | 1 + Tests/LibWeb/Text/input/invalid-transform-origin.html | 8 ++++++++ 3 files changed, 12 insertions(+), 3 deletions(-) create mode 100644 Tests/LibWeb/Text/expected/invalid-transform-origin.txt create mode 100644 Tests/LibWeb/Text/input/invalid-transform-origin.html diff --git a/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp b/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp index 3481da4daa2..3f8b23cc38e 100644 --- a/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp +++ b/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp @@ -3907,14 +3907,14 @@ RefPtr Parser::parse_transform_origin_value(TokenStreamoffset->is_length() || first_value->offset->is_percentage()) && second_value->axis == Axis::X) return nullptr; if ((second_value->offset->is_length() || second_value->offset->is_percentage()) && first_value->axis == Axis::Y) return nullptr; - if (!first_value.has_value() || !second_value.has_value()) - return nullptr; - if (!third_value) third_value = zero_value; diff --git a/Tests/LibWeb/Text/expected/invalid-transform-origin.txt b/Tests/LibWeb/Text/expected/invalid-transform-origin.txt new file mode 100644 index 00000000000..aaecaf93c4a --- /dev/null +++ b/Tests/LibWeb/Text/expected/invalid-transform-origin.txt @@ -0,0 +1 @@ +PASS (didn't crash) diff --git a/Tests/LibWeb/Text/input/invalid-transform-origin.html b/Tests/LibWeb/Text/input/invalid-transform-origin.html new file mode 100644 index 00000000000..d730b620983 --- /dev/null +++ b/Tests/LibWeb/Text/input/invalid-transform-origin.html @@ -0,0 +1,8 @@ + + +
+