LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-11 05:25:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Clamp paintable box maximum scroll offset to 0

Browse Source 
Previously calling `PaintableBox::set_scroll_offset()` with a
PaintableBox whose content size was larger than its scrollble overflow
rect would cause a crash.

Found by Domato.
This commit is contained in:
Tim Ledbetter 2024-07-21 17:18:47 +01:00 committed by Andreas Kling
parent 6b88e43b3b
commit 604f6040a1
Notes: github-actions[bot] 2024-07-22 07:14:27 +00:00 
Author: https://github.com/tcl3
Commit: https://github.com/LadybirdBrowser/ladybird/commit/604f6040a18
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/758
3 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/Element-scrollby-negative-scroll-offset-crash.txt Normal file
View File

@ -0,0 +1 @@
PASS (didn't crash)

16
Tests/LibWeb/Text/input/Element-scrollby-negative-scroll-offset-crash.html Normal file
View File

@ -0,0 +1,16 @@
<!DOCTYPE html>
<style>
#test {
height: 0;
}
</style>
<script src="include.js"></script>
<div id="test">test</div>
<script>
test(() => {
const divElement = document.getElementById("test");
divElement.scrollBy(1, 1);
divElement.remove();
println("PASS (didn't crash)");
});
</script>

5
Userland/Libraries/LibWeb/Painting/PaintableBox.cpp
View File

@ -82,8 +82,9 @@ void PaintableBox::set_scroll_offset(CSSPixelPoint offset)
document().set_needs_to_refresh_clip_state(true);
document().set_needs_to_refresh_scroll_state(true);
auto max_x_offset = scrollable_overflow_rect->width() - content_size().width();
auto max_y_offset = scrollable_overflow_rect->height() - content_size().height();
auto max_x_offset = max(scrollable_overflow_rect->width() - content_size().width(), 0);
auto max_y_offset = max(scrollable_overflow_rect->height() - content_size().height(), 0);
offset.set_x(clamp(offset.x(), 0, max_x_offset));
offset.set_y(clamp(offset.y(), 0, max_y_offset));