Changeset 19491 in webkit

Timestamp:

Feb 7, 2007 9:06:44 PM (17 years ago)

Author:

bdash

Message:

2007-02-07 Christopher Brichford <​chrisb@adobe.com>

Reviewed by Brady.

​http://bugs.webkit.org/show_bug.cgi?id=6286
Very large (~500MB) images cause reproducible Safari crash

• loader/CachedImage.cpp: (WebCore::CachedImage::bufferData): Detect failure to create a large Vector<> and call error() when that happens.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/CachedImage.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2007-02-07  Christopher Brichford  <chrisb@adobe.com>
+
+        Reviewed by Brady.
+
+        http://bugs.webkit.org/show_bug.cgi?id=6286
+        Very large (~500MB) images cause reproducible Safari crash
+
+        * loader/CachedImage.cpp: 
+        (WebCore::CachedImage::bufferData): Detect failure to create a
+        large Vector<> and call error() when that happens.
+
 2007-02-07  Mitz Pettel  <mitz@webkit.org>
 

trunk/WebCore/loader/CachedImage.cpp

@@ -167 +167 @@
     createImage();
 
-    // Add new bytes DIRECTLY to the buffer in the Image object.
-    Vector<char>& buffer = m_image->dataBuffer();
-
-    unsigned oldSize = buffer.size();
-    buffer.resize(oldSize + addedSize);
-    memcpy(buffer.data() + oldSize, bytes, addedSize);
-
-    return buffer;
+    Vector<char>& imageBuffer = m_image->dataBuffer();
+
+    if (addedSize > 0) {
+        bool success = false;
+        unsigned oldSize = imageBuffer.size();
+        unsigned newSize = oldSize + addedSize;
+
+        // Check for overflow
+        if (newSize > oldSize) {
+            // Use temporary Vector so we can safely detect if the allocation fails
+            //
+            // The code that was here before, just called resize of the imageBuffer.  Vector<>::resize
+            // will crash if the resize of a non-empty Vector<> fails.
+            Vector<char> tempBuffer(newSize);
+
+            char* tempBufferBytes = tempBuffer.data();
+            if (tempBufferBytes) {
+                memcpy(tempBufferBytes, imageBuffer.data(), oldSize);
+                memcpy(tempBufferBytes + oldSize, bytes, addedSize);
+                tempBuffer.swap(imageBuffer);
+                success = true;
+            }
+        }
+
+        if (!success)
+            error();
+    }
+
+    return imageBuffer;
 }