css: Don't crash on invalid rotate3d()

diff --git a/gtk/gtkcsstransformvalue.c b/gtk/gtkcsstransformvalue.c
index 6cec8cd7c09e359ee1d9bfc93444e30f5e413c8b..0b59cdee87cc429b0623fec3df394c91f0e32135 100644 (file)
--- a/gtk/gtkcsstransformvalue.c
+++ b/gtk/gtkcsstransformvalue.c
@@ -942,7 +942,7 @@ _gtk_css_transform_value_parse (GtkCssParser *parser)
 
   while (TRUE)
     {
-      GtkCssTransform transform;
+      GtkCssTransform transform = { 0, };
 
       if (gtk_css_parser_has_function (parser, "matrix"))
         {

diff --git a/testsuite/css/parser/meson.build b/testsuite/css/parser/meson.build
index 07f2ca4a73359ebf4c090d5c6aaffedf03e8eae1..d0fdd0d9a98037377fcba880877dd7ec5dbf2bd7 100644 (file)
--- a/testsuite/css/parser/meson.build
+++ b/testsuite/css/parser/meson.build
@@ -452,6 +452,9 @@ test_data = [
   'radial-positions.errors',
   'radial-positions.ref.css',
   'radial.ref.css',
+  'rotate3d-crash.css',
+  'rotate3d-crash.errors',
+  'rotate3d-crash.ref.css',
   'selector.css',
   'selector.ref.css',
   'selector-original.css',

diff --git a/testsuite/css/parser/rotate3d-crash.css b/testsuite/css/parser/rotate3d-crash.css
new file mode 100644 (file)
index 0000000..7e0b45c
--- /dev/null
+++ b/testsuite/css/parser/rotate3d-crash.css
@@ -0,0 +1,3 @@
+* {
+  transform: rotate3d(90,90,90);
+}

diff --git a/testsuite/css/parser/rotate3d-crash.errors b/testsuite/css/parser/rotate3d-crash.errors
new file mode 100644 (file)
index 0000000..57ab5b7
--- /dev/null
+++ b/testsuite/css/parser/rotate3d-crash.errors
@@ -0,0 +1 @@
+rotate3d-crash.css:2:31-32: error: GTK_CSS_PARSER_ERROR_SYNTAX

diff --git a/testsuite/css/parser/rotate3d-crash.ref.css b/testsuite/css/parser/rotate3d-crash.ref.css
new file mode 100644 (file)
index 0000000..e69de29