Changeset 152228 in webkit

Timestamp:

Jul 1, 2013 9:38:05 AM (11 years ago)

Author:

commit-queue@webkit.org

Message:

[Win] Crash when scrolling page with images.
​https://bugs.webkit.org/show_bug.cgi?id=117832

Patch by ​peavo@outlook.com <​peavo@outlook.com> on 2013-07-01
Reviewed by Brent Fulgham.

Avoid access violation by returning early from method if image frame doesn't have pixel data.

• platform/image-decoders/ImageDecoder.h:

(WebCore::ImageFrame::hasPixelData): Added method to check if frame has pixel data.

• platform/image-decoders/gif/GIFImageDecoder.cpp:

(WebCore::GIFImageDecoder::haveDecodedRow): Early return if frame doesn't have pixel data.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/image-decoders/ImageDecoder.h (modified) (1 diff)
• platform/image-decoders/gif/GIFImageDecoder.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-07-01  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Crash when scrolling page with images.
+        https://bugs.webkit.org/show_bug.cgi?id=117832
+
+        Reviewed by Brent Fulgham.
+
+        Avoid access violation by returning early from method if image frame doesn't have pixel data.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::hasPixelData): Added method to check if frame has pixel data.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow): Early return if frame doesn't have pixel data.
+
 2013-07-01  Noam Rosenthal  <noam@webkit.org>
 

trunk/Source/WebCore/platform/image-decoders/ImageDecoder.h

@@ -134 +134 @@
         }
 
+        inline bool hasPixelData() const
+        {
+            return m_bytes;
+        }
+
         // Use fix point multiplier instead of integer division or floating point math.
         // This multipler produces exactly the same result for all values in range 0 - 255.

trunk/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp

@@ -228 +228 @@
     // Initialize the frame if necessary.
     ImageFrame& buffer = m_frameBufferCache[frameIndex];
-    if ((buffer.status() == ImageFrame::FrameEmpty) && !initFrameBuffer(frameIndex))
+    if (((buffer.status() == ImageFrame::FrameEmpty) && !initFrameBuffer(frameIndex)) || !buffer.hasPixelData())
         return false;