Repository navigation
cssparser-color: debug assertion in hsl_to_rgb for a hue that overflows f32 #460
Description
A hue that overflows f32 makes normalize_hue return NaN. Examples are hwb(1e40 0% 0%) and hsl(1e40 50% 50%). In a debug build, to_css_string() on the parsed color then panics:
panicked at color/lib.rs:307:5:
assertion failed: (0.0..=1.0).contains(&hue)
hwb(1e30 0% 0%) does not panic, because 1e30 still fits in an f32.
normalize_hue computes hue - 360.0 * (hue / 360.0).floor(). For an infinite hue, this is inf - inf, which is NaN. A release build does not panic, but the output is wrong:
| Input | Release output |
|---|---|
hwb(1e40 0% 0%) |
rgb(0, 0, 0) |
hsl(1e40 50% 50%) |
rgb(64, 64, 64) |
lch(50% 30 1e40) |
lch(50 30 calc(NaN)) |
The spec gives the expected result. CSS Color 4 says that hsl(calc(infinity) 0 0) and hsl(calc(-infinity) 0 0) normalize the hue to 0 degrees. CSS Values 4 censors NaN to 0. So hwb(1e40 0% 0%) must give rgb(255, 0, 0).
Reproduced on main at 9f3cedd.
Related: #167 is about non-finite numbers from the tokenizer in general.
Found by fuzzing Fallow (https://github.com/fallow-rs/fallow) with OSS-Fuzz.
Activity