diff --git a/Tests/LibWeb/Layout/expected/svg/svg-as-image-invalid.txt b/Tests/LibWeb/Layout/expected/svg/svg-as-image-invalid.txt new file mode 100644 index 00000000000..22719b50a55 --- /dev/null +++ b/Tests/LibWeb/Layout/expected/svg/svg-as-image-invalid.txt @@ -0,0 +1,4 @@ +Viewport <#document> at (0,0) content-size 800x600 children: not-inline + BlockContainer at (0,0) content-size 800x48 [BFC] children: not-inline + BlockContainer at (8,8) content-size 784x32 children: not-inline + ImageBox at (8,8) content-size 16x32 children: not-inline diff --git a/Tests/LibWeb/Layout/input/svg/svg-as-image-invalid.html b/Tests/LibWeb/Layout/input/svg/svg-as-image-invalid.html new file mode 100644 index 00000000000..a7f142a7395 --- /dev/null +++ b/Tests/LibWeb/Layout/input/svg/svg-as-image-invalid.html @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/Userland/Libraries/LibWeb/SVG/SVGDecodedImageData.cpp b/Userland/Libraries/LibWeb/SVG/SVGDecodedImageData.cpp index 347a9540906..702d45a3854 100644 --- a/Userland/Libraries/LibWeb/SVG/SVGDecodedImageData.cpp +++ b/Userland/Libraries/LibWeb/SVG/SVGDecodedImageData.cpp @@ -70,6 +70,9 @@ ErrorOr> SVGDecodedImageData::create(Page& ho // Perform some DOM surgery to make the SVG root element be the first child of the Document. // FIXME: This is a huge hack until we figure out how to actually parse separate SVG files. auto* svg_root = document->body()->first_child_of_type(); + if (!svg_root) + return Error::from_string_literal("SVGDecodedImageData: Invalid SVG input"); + svg_root->remove(); document->remove_all_children();