Changeset 215632 in webkit

Timestamp:

Apr 21, 2017, 1:07:07 PM (9 years ago)

Author:

Brent Fulgham

Message:

Validate vImage arguments
​https://bugs.webkit.org/show_bug.cgi?id=171109
Source/WebCore:

rdar://problem/30236606

Patch by Per Arne Vollan <​pvollan@apple.com> on 2017-04-21
Reviewed by Brent Fulgham.

When writing data to a canvas context, clip the source rectangle to the data rectangle
to make sure we will not attempt to read data outside of the buffer.

Test: fast/canvas/canvas-crash.html

• html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::putImageData):

LayoutTests:

Patch by Per Arne Vollan <​pvollan@apple.com> on 2017-04-21
Reviewed by Brent Fulgham.

• fast/canvas/canvas-crash-expected.txt: Added.
• fast/canvas/canvas-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/canvas-crash-expected.txt (added)
• LayoutTests/fast/canvas/canvas-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-04-21  Per Arne Vollan  <pvollan@apple.com>
+
+        Validate vImage arguments
+        https://bugs.webkit.org/show_bug.cgi?id=171109
+
+        Reviewed by Brent Fulgham.
+
+        * fast/canvas/canvas-crash-expected.txt: Added.
+        * fast/canvas/canvas-crash.html: Added.
+
 2017-04-21  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-04-21  Per Arne Vollan  <pvollan@apple.com>
+
+        Validate vImage arguments
+        https://bugs.webkit.org/show_bug.cgi?id=171109
+        rdar://problem/30236606
+
+        Reviewed by Brent Fulgham.
+
+        When writing data to a canvas context, clip the source rectangle to the data rectangle
+        to make sure we will not attempt to read data outside of the buffer.
+
+        Test: fast/canvas/canvas-crash.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::putImageData):
+
 2017-04-21  David Kilzer  <ddkilzer@apple.com>
 

trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp

@@ -2088 +2088 @@
     IntRect sourceRect(destRect);
     sourceRect.move(-destOffset);
-
-    buffer->putByteArray(Unmultiplied, data.data(), IntSize(data.width(), data.height()), sourceRect, IntPoint(destOffset), coordinateSystem);
+    sourceRect.intersect(IntRect(0, 0, data.width(), data.height()));
+
+    if (!sourceRect.isEmpty())
+        buffer->putByteArray(Unmultiplied, data.data(), IntSize(data.width(), data.height()), sourceRect, IntPoint(destOffset), coordinateSystem);
 
     didDraw(destRect, CanvasDidDrawApplyNone); // ignore transform, shadow and clip