Changeset 272845 in webkit

Timestamp:

Feb 15, 2021, 2:38:30 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in RetainPtr<CGImage*>::RetainPtr via ImageBufferCGBackend::toCFData
​https://bugs.webkit.org/show_bug.cgi?id=221376

Patch by Frederic Wang <​fwang@igalia.com> on 2021-02-15
Reviewed by Said Abou-Hallawa.

Source/WebCore:

Call to copyNativeImage(CopyBackingStore) may return a null pointer if CGBitmapContextCreateImage
does. This patch fixes a crash due to null pointer dereference and adds a similar check for
copyNativeImage(DontCopyBackingStore).

Test: fast/canvas/resize-to-large-canvas-and-convert-to-blog.html

• platform/graphics/cg/ImageBufferCGBackend.cpp:

(WebCore::ImageBufferCGBackend::toCFData const):

LayoutTests:

• fast/canvas/resize-to-large-canvas-and-convert-to-blog-expected.txt: Added.
• fast/canvas/resize-to-large-canvas-and-convert-to-blog-expected.txt: Added.
• fast/canvas/resize-to-large-canvas-and-convert-to-blog.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/resize-to-large-canvas-and-convert-to-blog-expected.txt (added)
• LayoutTests/fast/canvas/resize-to-large-canvas-and-convert-to-blog.html (added)
• LayoutTests/platform/ios/fast/canvas/resize-to-large-canvas-and-convert-to-blog-expected.txt (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/cg/ImageBufferCGBackend.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-02-15  Frederic Wang  <fwang@igalia.com>
+
+        Crash in RetainPtr<CGImage*>::RetainPtr via ImageBufferCGBackend::toCFData
+        https://bugs.webkit.org/show_bug.cgi?id=221376
+
+        Reviewed by Said Abou-Hallawa.
+
+        * fast/canvas/resize-to-large-canvas-and-convert-to-blog-expected.txt: Added.
+        * fast/canvas/resize-to-large-canvas-and-convert-to-blog-expected.txt: Added.
+        * fast/canvas/resize-to-large-canvas-and-convert-to-blog.html: Added.
+
 2021-02-14  Peng Liu  <peng.liu6@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-15  Frederic Wang  <fwang@igalia.com>
+
+        Crash in RetainPtr<CGImage*>::RetainPtr via ImageBufferCGBackend::toCFData
+        https://bugs.webkit.org/show_bug.cgi?id=221376
+
+        Reviewed by Said Abou-Hallawa.
+
+        Call to copyNativeImage(CopyBackingStore) may return a null pointer if CGBitmapContextCreateImage
+        does. This patch fixes a crash due to null pointer dereference and adds a similar check for
+        copyNativeImage(DontCopyBackingStore).
+
+        Test: fast/canvas/resize-to-large-canvas-and-convert-to-blog.html
+
+        * platform/graphics/cg/ImageBufferCGBackend.cpp:
+        (WebCore::ImageBufferCGBackend::toCFData const):
+
 2021-02-15  Manuel Rego Casasnovas  <rego@igalia.com>
 

trunk/Source/WebCore/platform/graphics/cg/ImageBufferCGBackend.cpp

@@ -192 +192 @@
         image = adoptCF(CGImageCreate(pixelArrayDimensions.width(), pixelArrayDimensions.height(), 8, 32, 4 * pixelArrayDimensions.width(), sRGBColorSpaceRef(), kCGBitmapByteOrderDefault | kCGImageAlphaNoneSkipLast, dataProvider.get(), 0, false, kCGRenderingIntentDefault));
     } else if (resolutionScale() == 1 || preserveResolution == PreserveResolution::Yes) {
-        image = copyNativeImage(CopyBackingStore)->platformImage();
+        auto nativeImage = copyNativeImage(CopyBackingStore);
+        if (!nativeImage)
+            return nullptr;
+        image = nativeImage->platformImage();
         image = createCroppedImageIfNecessary(image.get(), backendSize());
     } else {
-        image = copyNativeImage(DontCopyBackingStore)->platformImage();
+        auto nativeImage = copyNativeImage(DontCopyBackingStore);
+        if (!nativeImage)
+            return nullptr;
+        image = nativeImage->platformImage();
         auto context = adoptCF(CGBitmapContextCreate(0, backendSize().width(), backendSize().height(), 8, 4 * backendSize().width(), sRGBColorSpaceRef(), kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host));
         CGContextSetBlendMode(context.get(), kCGBlendModeCopy);