From d2504e5f8b79fad5803c72afd634e901e1e96a12 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Sat, 31 Oct 2026 00:56:17 -0400
Subject: [PATCH] Motion paths: a raw path string must parse to at least two
 finite points

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/engine/src/cmd/animation.rs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/cmd/animation.rs b/crates/engine/src/cmd/animation.rs
index e69d97b6..b03e4918 100644
--- a/crates/engine/src/cmd/animation.rs
+++ b/crates/engine/src/cmd/animation.rs
@@ -191,7 +191,12 @@ fn path_param(p: &Value, slide: (f64, f64)) -> Result<Option<String>> {
         Value::String(text) => {
             let ok = text.len() <= MAX_PATH_TEXT
                 && text.contains(|c: char| c.is_ascii_digit())
-                && text.chars().all(|c| c.is_ascii_digit() || " .+-eE,MmLlCcQqHhVvZz".contains(c));
+                && text.chars().all(|c| c.is_ascii_digit() || " .+-eE,MmLlCcQqHhVvZz".contains(c))
+                // it must also draw: at least two finite points once parsed the way the show plays it
+                && {
+                    let pts = deckcraft_anim::MotionPath::parse(text).points;
+                    pts.len() >= 2 && pts.iter().all(|(x, y)| x.is_finite() && y.is_finite())
+                };
             if !ok {
                 return Err(refuse("string must be an OOXML motion path such as `M 0 0 L 0.25 0 E` (at most 16 KiB)"));
             }
@@ -733,6 +738,8 @@ mod tests {
             json!([[0, 0], [null, 1]]),
             json!("M 0 0 L <script> E"),
             json!("not a path"),
+            json!("eeee1"),
+            json!("M 0 0 L 1e999 0 E"),
             json!(5),
             Value::Array(many),
             Value::String("M 0 0 L 0.1 0.1 ".repeat(10_000)),