Changeset 202887 in webkit
- Timestamp:
- Jul 6, 2016 6:02:57 PM (8 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 8 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r202886 r202887 1 2016-07-06 Brent Fulgham <bfulgham@apple.com> 2 3 Return values of JSArray::createUninitialized (and related) are not consistently checked for nullptr 4 https://bugs.webkit.org/show_bug.cgi?id=159495 5 <rdar://problem/26075433> 6 7 Reviewed by Dean Jackson. 8 9 * fast/canvas/canvas-getImageData-invalid-result-buffer-crash.html: Added. 10 * fast/canvas/canvas-getImageData-invalid-result-buffer-crash-expected.txt: Added. 11 1 12 2016-07-06 Ryan Haddad <ryanhaddad@apple.com> 2 13 -
trunk/Source/WebCore/ChangeLog
r202881 r202887 1 2016-07-06 Brent Fulgham <bfulgham@apple.com> 2 3 Return values of JSArray::createUninitialized (and related) are not consistently checked for nullptr 4 https://bugs.webkit.org/show_bug.cgi?id=159495 5 <rdar://problem/26075433> 6 7 Reviewed by Dean Jackson. 8 9 Test: fast/canvas/canvas-getImageData-invalid-result-buffer-crash.html 10 11 * html/ImageData.cpp: 12 (WebCore::ImageData::ImageData): Assert at construction if we could not create a valid 13 buffer. 14 * platform/SharedBuffer.cpp: 15 (WebCore::SharedBuffer::createArrayBuffer): Check for a null buffer before using it. 16 * platform/graphics/cg/ImageBufferDataCG.cpp: 17 (WebCore::ImageBufferData::getData): Ditto. 18 * platform/graphics/filters/FEGaussianBlur.cpp: 19 (WebCore::FEGaussianBlur::platformApplySoftware): Ditto. 20 * platform/graphics/filters/FilterEffect.cpp: 21 (WebCore::FilterEffect::copyImageBytes): Ditto. 22 (WebCore::FilterEffect::copyUnmultipliedImage): Ditto. 23 (WebCore::FilterEffect::copyPremultipliedImage): Ditto. 24 1 25 2016-07-06 Chris Dumez <cdumez@apple.com> 2 26 -
trunk/Source/WebCore/html/ImageData.cpp
r200298 r202887 1 1 /* 2 * Copyright (C) 2008 Apple Inc. All rights reserved.2 * Copyright (C) 2008-2016 Apple Inc. All rights reserved. 3 3 * Copyright (C) 2014 Adobe Systems Incorporated. All rights reserved. 4 4 * … … 116 116 , m_data(Uint8ClampedArray::createUninitialized(size.width() * size.height() * 4)) 117 117 { 118 ASSERT_WITH_SECURITY_IMPLICATION(m_data); 118 119 } 119 120 -
trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
r202877 r202887 2032 2032 2033 2033 RefPtr<Uint8ClampedArray> byteArray = buffer->getUnmultipliedImageData(imageDataRect, coordinateSystem); 2034 if (!byteArray) 2034 if (!byteArray) { 2035 StringBuilder consoleMessage; 2036 consoleMessage.appendLiteral("Unable to get image data from canvas. Requested size was "); 2037 consoleMessage.appendNumber(imageDataRect.width()); 2038 consoleMessage.appendLiteral(" x "); 2039 consoleMessage.appendNumber(imageDataRect.height()); 2040 2041 canvas()->document().addConsoleMessage(MessageSource::Rendering, MessageLevel::Error, consoleMessage.toString()); 2042 ec = INVALID_STATE_ERR; 2035 2043 return nullptr; 2044 } 2036 2045 2037 2046 return ImageData::create(imageDataRect.size(), byteArray.releaseNonNull()); -
trunk/Source/WebCore/platform/SharedBuffer.cpp
r201761 r202887 1 1 /* 2 * Copyright (C) 2006 , 2008Apple Inc. All rights reserved.2 * Copyright (C) 2006-2016 Apple Inc. All rights reserved. 3 3 * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved. 4 4 * Copyright (C) 2015 Canon Inc. All rights reserved. … … 145 145 { 146 146 RefPtr<ArrayBuffer> arrayBuffer = ArrayBuffer::createUninitialized(static_cast<unsigned>(size()), sizeof(char)); 147 if (!arrayBuffer) { 148 WTFLogAlways("SharedBuffer::createArrayBuffer Unable to create buffer. Requested size was %d x %lu\n", size(), sizeof(char)); 149 return nullptr; 150 } 147 151 148 152 const char* segment = 0; -
trunk/Source/WebCore/platform/graphics/cg/ImageBufferDataCG.cpp
r202242 r202887 1 1 /* 2 * Copyright (C) 2011 Apple Inc. All rights reserved.2 * Copyright (C) 2011-2016 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 98 98 99 99 auto result = Uint8ClampedArray::createUninitialized(area.unsafeGet()); 100 unsigned char* resultData = result->data(); 101 if (!resultData) { 102 WTFLogAlways("ImageBufferData: Unable to create buffer. Requested size was %d x %d = %u\n", rect.width(), rect.height(), area.unsafeGet()); 100 unsigned char* resultData = result ? result->data() : nullptr; 101 if (!resultData) 103 102 return nullptr; 104 }105 103 106 104 Checked<int> endx = rect.maxX(); -
trunk/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
r183381 r202887 6 6 * Copyright (C) 2010 Igalia, S.L. 7 7 * Copyright (C) Research In Motion Limited 2010. All rights reserved. 8 * Copyright (C) 2015 Apple, Inc. All rights reserved.8 * Copyright (C) 2015-2016 Apple, Inc. All rights reserved. 9 9 * 10 10 * This library is free software; you can redistribute it and/or … … 541 541 paintSize.scale(filter().filterScale()); 542 542 RefPtr<Uint8ClampedArray> tmpImageData = Uint8ClampedArray::createUninitialized(paintSize.width() * paintSize.height() * 4); 543 Uint8ClampedArray* tmpPixelArray = tmpImageData.get(); 544 545 platformApply(srcPixelArray, tmpPixelArray, kernelSize.width(), kernelSize.height(), paintSize); 543 if (!tmpImageData) { 544 WTFLogAlways("FEGaussianBlur::platformApplySoftware Unable to create buffer. Requested size was %d x %d\n", paintSize.width(), paintSize.height()); 545 return; 546 } 547 548 platformApply(srcPixelArray, tmpImageData.get(), kernelSize.width(), kernelSize.height(), paintSize); 546 549 } 547 550 -
trunk/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
r202242 r202887 4 4 * Copyright (C) Research In Motion Limited 2010. All rights reserved. 5 5 * Copyright (C) 2012 University of Szeged 6 * Copyright (C) 2015 Apple Inc. All rights reserved.6 * Copyright (C) 2015-2016 Apple Inc. All rights reserved. 7 7 * 8 8 * This library is free software; you can redistribute it and/or … … 260 260 scaledPaintSize.scale(m_filter.filterScale()); 261 261 262 if (!source || !destination) 263 return; 264 262 265 // Initialize the destination to transparent black, if not entirely covered by the source. 263 266 if (scaledRect.x() < 0 || scaledRect.y() < 0 || scaledRect.maxX() > scaledPaintSize.width() || scaledRect.maxY() > scaledPaintSize.height()) … … 315 318 inputSize.scale(m_filter.filterScale()); 316 319 m_unmultipliedImageResult = Uint8ClampedArray::createUninitialized(inputSize.width() * inputSize.height() * 4); 320 if (!m_unmultipliedImageResult) { 321 WTFLogAlways("FilterEffect::copyUnmultipliedImage Unable to create buffer. Requested size was %d x %d\n", inputSize.width(), inputSize.height()); 322 return; 323 } 317 324 unsigned char* sourceComponent = m_premultipliedImageResult->data(); 318 325 unsigned char* destinationComponent = m_unmultipliedImageResult->data(); … … 351 358 inputSize.scale(m_filter.filterScale()); 352 359 m_premultipliedImageResult = Uint8ClampedArray::createUninitialized(inputSize.width() * inputSize.height() * 4); 360 if (!m_premultipliedImageResult) { 361 WTFLogAlways("FilterEffect::copyPremultipliedImage Unable to create buffer. Requested size was %d x %d\n", inputSize.width(), inputSize.height()); 362 return; 363 } 353 364 unsigned char* sourceComponent = m_unmultipliedImageResult->data(); 354 365 unsigned char* destinationComponent = m_premultipliedImageResult->data();
Note: See TracChangeset
for help on using the changeset viewer.