From 052b5d1ffafc7408a941d0a19ff1589bd16c5b93 Mon Sep 17 00:00:00 2001 From: erixreyes Date: Sat, 26 Jul 2025 05:51:57 +0800 Subject: [PATCH] Issue #2489: Disallow percentage overflow and underflow --- layout/style/nsCSSParser.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp index f17474e7d6..f885cb45e3 100644 --- a/layout/style/nsCSSParser.cpp +++ b/layout/style/nsCSSParser.cpp @@ -7491,9 +7491,11 @@ CSSParserImpl::ParseColor(nsCSSValue& aValue) if (mToken.mType == eCSSToken_Percentage) { w1 = mToken.mNumber; // percentage tokens are already normalized (0.0-1.0) w1_specified = true; - // clamp to valid range [0, 1] - if (w1 < 0.0f) w1 = 0.0f; - if (w1 > 1.0f) w1 = 1.0f; + // Reject invalid percentages (outside 0-100% range) + if (w1 < 0.0f || w1 > 1.0f) { + SkipUntil(')'); + return CSSParseResult::Error; + } } else { UngetToken(); } @@ -7517,9 +7519,11 @@ CSSParserImpl::ParseColor(nsCSSValue& aValue) if (mToken.mType == eCSSToken_Percentage) { w2 = mToken.mNumber; // percentage tokens are already normalized (0.0-1.0) w2_specified = true; - // Clamp to valid range [0, 1] - if (w2 < 0.0f) w2 = 0.0f; - if (w2 > 1.0f) w2 = 1.0f; + // Reject invalid percentages (outside 0-100% range) + if (w2 < 0.0f || w2 > 1.0f) { + SkipUntil(')'); + return CSSParseResult::Error; + } } else { UngetToken(); }