Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1998)

Unified Diff: Source/core/svg/animation/SVGSMILElement.cpp

Issue 406263002: Make sure that begin time cannot be greater than (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Moving checks into the parser Created 6 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « LayoutTests/svg/animations/animateMotion-crash-with-large-begin-time-expected.txt ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/core/svg/animation/SVGSMILElement.cpp
diff --git a/Source/core/svg/animation/SVGSMILElement.cpp b/Source/core/svg/animation/SVGSMILElement.cpp
index 9f2321f8714f0437416d07e96678d104118fd427..903b246481fc94a26cfe1086e3ce0d76039b337b 100644
--- a/Source/core/svg/animation/SVGSMILElement.cpp
+++ b/Source/core/svg/animation/SVGSMILElement.cpp
@@ -370,7 +370,7 @@ SMILTime SVGSMILElement::parseOffsetValue(const String& data)
result = parse.left(parse.length() - 1).toDouble(&ok);
else
result = parse.toDouble(&ok);
- if (!ok)
+ if (!ok || !SMILTime(result).isFinite())
return SMILTime::unresolved();
return result;
}
@@ -406,7 +406,7 @@ SMILTime SVGSMILElement::parseClockValue(const String& data)
} else
return parseOffsetValue(parse);
- if (!ok)
+ if (!ok || !SMILTime(result).isFinite())
return SMILTime::unresolved();
return result;
}
« no previous file with comments | « LayoutTests/svg/animations/animateMotion-crash-with-large-begin-time-expected.txt ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698