From 9402a6e4e13d19234efbe513fdbaef2e17b314f8 Mon Sep 17 00:00:00 2001 From: sideshowbarker Date: Sun, 21 Jun 2026 18:22:37 +0900 Subject: [PATCH] LibWeb: Saturate CSSPixels unary negation at the i32 minimum MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Problem: UBSan crash when computing layout for an element with a giant negative inset. Cause: CSSPixels::operator-() returned from_raw(-raw_value()), and negating the i32 minimum overflows int. Fix: Negate with saturating_sub(0, raw_value()) — matching the saturating arithmetic already used by the other CSSPixels operators. Fixes https://github.com/LadybirdBrowser/ladybird/issues/9997 --- Libraries/LibWeb/PixelUnits.h | 2 +- .../css-pixels-saturated-negation.txt | 1 + .../input/css-pixels-saturated-negation.html | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 Tests/LibWeb/Text/expected/css-pixels-saturated-negation.txt create mode 100644 Tests/LibWeb/Text/input/css-pixels-saturated-negation.html diff --git a/Libraries/LibWeb/PixelUnits.h b/Libraries/LibWeb/PixelUnits.h index 8d5acd509f..af1f4f937d 100644 --- a/Libraries/LibWeb/PixelUnits.h +++ b/Libraries/LibWeb/PixelUnits.h @@ -180,7 +180,7 @@ public: } constexpr CSSPixels operator+() const { return from_raw(+raw_value()); } - constexpr CSSPixels operator-() const { return from_raw(-raw_value()); } + constexpr CSSPixels operator-() const { return from_raw(saturating_sub(0, raw_value())); } constexpr CSSPixels operator+(CSSPixels const& other) const { diff --git a/Tests/LibWeb/Text/expected/css-pixels-saturated-negation.txt b/Tests/LibWeb/Text/expected/css-pixels-saturated-negation.txt new file mode 100644 index 0000000000..aaecaf93c4 --- /dev/null +++ b/Tests/LibWeb/Text/expected/css-pixels-saturated-negation.txt @@ -0,0 +1 @@ +PASS (didn't crash) diff --git a/Tests/LibWeb/Text/input/css-pixels-saturated-negation.html b/Tests/LibWeb/Text/input/css-pixels-saturated-negation.html new file mode 100644 index 0000000000..7af2c86113 --- /dev/null +++ b/Tests/LibWeb/Text/input/css-pixels-saturated-negation.html @@ -0,0 +1,19 @@ + + + +
+