Changeset 71277 in webkit


Ignore:
Timestamp:
Nov 3, 2010 3:58:30 PM (13 years ago)
Author:
abarth@webkit.org
Message:

2010-11-03 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CG use of WebKit image decoders crashes on some animated GIFs
​https://bugs.webkit.org/show_bug.cgi?id=48955

It turns out CFDataGetMutableBytePtr isn't safe call on a null pointer.

Test: fast/images/dont-crash-with-null-gif-frames.html

  • platform/image-decoders/cg/ImageDecoderCG.cpp: (WebCore::RGBA32Buffer::copyReferenceToBitmapData): (WebCore::RGBA32Buffer::copyBitmapData):

2010-11-03 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

CG use of WebKit image decoders crashes on some animated GIFs
​https://bugs.webkit.org/show_bug.cgi?id=48955

Test image from Wikipedia that was crashing.

  • fast/images/dont-crash-with-null-gif-frames-expected.txt: Added.
  • fast/images/dont-crash-with-null-gif-frames.html: Added.
  • fast/images/resources/quicksort.gif: Added.
Location:
trunk
Files:
3 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r71276 r71277  
     12010-11-03  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        CG use of WebKit image decoders crashes on some animated GIFs
     6        https://bugs.webkit.org/show_bug.cgi?id=48955
     7
     8        Test image from Wikipedia that was crashing.
     9
     10        * fast/images/dont-crash-with-null-gif-frames-expected.txt: Added.
     11        * fast/images/dont-crash-with-null-gif-frames.html: Added.
     12        * fast/images/resources/quicksort.gif: Added.
     13
    1142010-11-03  Csaba Osztrogonác  <ossy@webkit.org>
    215

  • trunk/WebCore/ChangeLog

    r71274 r71277  
     12010-11-03  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Eric Seidel.
     4
     5        CG use of WebKit image decoders crashes on some animated GIFs
     6        https://bugs.webkit.org/show_bug.cgi?id=48955
     7
     8        It turns out CFDataGetMutableBytePtr isn't safe call on a null pointer.
     9
     10        Test: fast/images/dont-crash-with-null-gif-frames.html
     11
     12        * platform/image-decoders/cg/ImageDecoderCG.cpp:
     13        (WebCore::RGBA32Buffer::copyReferenceToBitmapData):
     14        (WebCore::RGBA32Buffer::copyBitmapData):
     15
    1162010-11-03  Adrienne Walker  <enne@google.com>
    217

  • trunk/WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp

    r71098 r71277  
    3232namespace WebCore {
    3333
     34static RGBA32Buffer::PixelData* getPtrAsPixelData(CFMutableDataRef data)
     35{
     36    return data ? reinterpret_cast<RGBA32Buffer::PixelData*>(CFDataGetMutableBytePtr(data)) : 0;
     37}
     38   
    3439void RGBA32Buffer::copyReferenceToBitmapData(const RGBA32Buffer& other)
    3540{
    3641    ASSERT(this != &other);
    3742    m_backingStore = other.m_backingStore;
    38     m_bytes = reinterpret_cast<PixelData*>(CFDataGetMutableBytePtr(m_backingStore.get()));
     43    m_bytes = getPtrAsPixelData(m_backingStore.get());
    3944    // FIXME: The rest of this function seems redundant with RGBA32Buffer::copyBitmapData.
    4045    m_size = other.m_size;
    … …  
    4853
    4954    m_backingStore.adoptCF(CFDataCreateMutableCopy(kCFAllocatorDefault, 0, other.m_backingStore.get()));
    50     m_bytes = reinterpret_cast<PixelData*>(CFDataGetMutableBytePtr(m_backingStore.get()));
     55    m_bytes = getPtrAsPixelData(m_backingStore.get());
    5156    m_size = other.m_size;
    5257    setHasAlpha(other.m_hasAlpha);
Note: See TracChangeset for help on using the changeset viewer.