Issue #2489: Disallow percentage overflow and underflow

This commit is contained in:
erixreyes 2025-07-26 05:51:57 +08:00 • committed by roytam1
commit 052b5d1ffa

View file

@ -7491,9 +7491,11 @@ CSSParserImpl::ParseColor(nsCSSValue& aValue)
if (mToken.mType == eCSSToken_Percentage) { if (mToken.mType == eCSSToken_Percentage) {
w1 = mToken.mNumber; // percentage tokens are already normalized (0.0-1.0) w1 = mToken.mNumber; // percentage tokens are already normalized (0.0-1.0)
w1_specified = true; w1_specified = true;
// clamp to valid range [0, 1] // Reject invalid percentages (outside 0-100% range)
if (w1 < 0.0f) w1 = 0.0f; if (w1 < 0.0f || w1 > 1.0f) {
if (w1 > 1.0f) w1 = 1.0f; SkipUntil(')');
return CSSParseResult::Error;
}
} else { } else {
UngetToken(); UngetToken();
} }
@ -7517,9 +7519,11 @@ CSSParserImpl::ParseColor(nsCSSValue& aValue)
if (mToken.mType == eCSSToken_Percentage) { if (mToken.mType == eCSSToken_Percentage) {
w2 = mToken.mNumber; // percentage tokens are already normalized (0.0-1.0) w2 = mToken.mNumber; // percentage tokens are already normalized (0.0-1.0)
w2_specified = true; w2_specified = true;
// Clamp to valid range [0, 1] // Reject invalid percentages (outside 0-100% range)
if (w2 < 0.0f) w2 = 0.0f; if (w2 < 0.0f || w2 > 1.0f) {
if (w2 > 1.0f) w2 = 1.0f; SkipUntil(')');
return CSSParseResult::Error;
}
} else { } else {
UngetToken(); UngetToken();
} }