Changeset 249375 in webkit

Timestamp:

Sep 1, 2019 11:03:07 PM (5 years ago)

Author:

Fujii Hironori

Message:

[Cairo] out-of-bounds read in ShareableBitmap::paint if a fractional device scale factor is used
​https://bugs.webkit.org/show_bug.cgi?id=196340

Reviewed by Brent Fulgham.

In ShareableBitmap::paint, srcRectScaled can be out-of-bounds of
the surface if a fractional device scale factor is used.

• Shared/cairo/ShareableBitmapCairo.cpp:

(WebKit::ShareableBitmap::paint): Use cairoSurfaceSetDeviceScale
to set a device scale factor to the surface instead of multiplying
srcRect with a device scale factor.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/cairo/ShareableBitmapCairo.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-09-01  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        [Cairo] out-of-bounds read in ShareableBitmap::paint if a fractional device scale factor is used
+        https://bugs.webkit.org/show_bug.cgi?id=196340
+
+        Reviewed by Brent Fulgham.
+
+        In ShareableBitmap::paint, srcRectScaled can be out-of-bounds of
+        the surface if a fractional device scale factor is used.
+
+        * Shared/cairo/ShareableBitmapCairo.cpp:
+        (WebKit::ShareableBitmap::paint): Use cairoSurfaceSetDeviceScale
+        to set a device scale factor to the surface instead of multiplying
+        srcRect with a device scale factor.
+
 2019-09-01  Fujii Hironori  <Hironori.Fujii@sony.com>
 

trunk/Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp

@@ -72 +72 @@
 {
     RefPtr<cairo_surface_t> surface = createSurfaceFromData(data(), m_size);
+    cairoSurfaceSetDeviceScale(surface.get(), scaleFactor, scaleFactor);
     FloatRect destRect(dstPoint, srcRect.size());
-    FloatRect srcRectScaled(srcRect);
-    srcRectScaled.scale(scaleFactor);
 
     ASSERT(context.hasPlatformContext());
     auto& state = context.state();
-    Cairo::drawSurface(*context.platformContext(), surface.get(), destRect, srcRectScaled, state.imageInterpolationQuality, state.alpha, Cairo::ShadowState(state));
+    Cairo::drawSurface(*context.platformContext(), surface.get(), destRect, srcRect, state.imageInterpolationQuality, state.alpha, Cairo::ShadowState(state));
 }