ChangeLog

2014-09-25  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Stack overflow with enormous SVG filter

        https://bugs.webkit.org/show_bug.cgi?id=63290

        Prevent building an SVG filter if it has more than 200 FilterEffect nodes in its map 

        regardless whether they will be connected to its lastEffect or not. Also discard any

        filter which has 100 or more contributing FilterEffect's in its tree.

        Reviewed by NOBODY (OOPS!).

        Tests: svg/filters/svg-deeply-nested-crash.html

        * platform/graphics/filters/FilterEffect.cpp:

        (WebCore::FilterEffect::depthOfEffectInputs):

        * platform/graphics/filters/FilterEffect.h:

        -- Add a method to return the total number of input FilterEffect's contributing to a FilterEffect.

        * rendering/svg/RenderSVGResourceFilter.cpp:

        (WebCore::RenderSVGResourceFilter::buildPrimitives):

        -- Do not build a filter if its has more than 200 FilterEffect's in its map.

        (WebCore::RenderSVGResourceFilter::applyResource):

        -- Discard a filter after it has more than 100 FilterEffect's in its tree.

2014-09-25  Jeremy Jones  <jeremyj@apple.com>

        Race in ref pointer for WebVideoFullscreenInterfaceAVKit.

173976

Source/WebCore/platform/graphics/filters/FilterEffect.cpp

@@FilterEffect* FilterEffect::inputEffect(

    return m_inputEffects.at(number).get();

}

unsigned FilterEffect::numberOfEffectInputsRecursive() const

{

    unsigned size = m_inputEffects.size();

    unsigned count = 0;

    for (unsigned i = 0; i < size; ++i) {

        FilterEffect* in = m_inputEffects.at(i).get();

        count += in->numberOfEffectInputsRecursive();

    }

    return count + 1;

}

#if ENABLE(OPENCL)

void FilterEffect::applyAll()

{

173660

Source/WebCore/platform/graphics/filters/FilterEffect.h

@@public:

    FilterEffectVector& inputEffects() { return m_inputEffects; }

    FilterEffect* inputEffect(unsigned) const;

    unsigned numberOfEffectInputs() const { return m_inputEffects.size(); }

81 unsigned numberOfEffectInputsRecursive() const;

    
    inline bool hasResult() const

    {

173660

Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp

@@void RenderSVGResourceFilter::removeClie

std::unique_ptr<SVGFilterBuilder> RenderSVGResourceFilter::buildPrimitives(SVGFilter* filter) const

{

    static const unsigned maxCountChildNodes = 200;

    if (filterElement().countChildNodes() > maxCountChildNodes)

        return nullptr;

    FloatRect targetBoundingBox = filter->targetBoundingBox();

    // Add effects to the builder

@@bool RenderSVGResourceFilter::applyResou

    // Set the scale level in SVGFilter.

    filterData->filter->setFilterResolution(scale);

179 static const unsigned maxNumberOfEffectInputsRecursive = 100;

175180 FilterEffect* lastEffect = filterData->builder->lastEffect();

176 if (!lastEffect)

181 if (!lastEffect || lastEffect->numberOfEffectInputsRecursive() > maxNumberOfEffectInputsRecursive)

        return false;

    RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(lastEffect);

173660

LayoutTests/ChangeLog

2014-09-25  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Stack overflow with enormous SVG filter.

        https://bugs.webkit.org/show_bug.cgi?id=63290.

        Reviewed by NOBODY (OOPS!).

        Test if an SVG filter with deeply nested tree of FilterEffect's can be loaded

        with no crash.  Make sure other valid filters can still be referenced by SVG 

        drawing elements.

        * svg/filters/svg-deeply-nested-crash-expected.txt: Added.

        * svg/filters/svg-deeply-nested-crash.html: Added.

2014-09-25  Javier Fernandez  <jfernandez@igalia.com>

        ASSERTION FAILED: columnCount in WebCore::CSSParser::parseGridTemplateAreasRow

173978

LayoutTests/svg/filters/svg-deeply-nested-crash-expected.txt

1PASS

0

LayoutTests/svg/filters/svg-deeply-nested-crash.html

<!DOCTYPE html>

<script>

if (window.testRunner)

    testRunner.dumpAsText();

window.addEventListener("load", function () {

  var filter = document.getElementById("ignored");

  for (var i = 0; i < 100000; i++) {

    var feElement = document.createElementNS("http://www.w3.org/2000/svg", "feGaussianBlur");

    feElement.setAttribute("stdDeviation", "1.0");

    filter.appendChild(feElement);

  }

}, false);

</script>

<svg width="500" height="300" xmlns="http://www.w3.org/2000/svg">

<defs>

  <filter id="ignored">

  </filter>

  <filter id="ShiftAndBlur">

    <feOffset dx="10" dy="10" />

    <feGaussianBlur stdDeviation="8.0" />

  </filter>

</defs>

<rect fill="red" x="10px" y="10px" width="20px" height="20px" filter="url(#ignored)"/>

<circle fill="green" cx="100" cy="100" r="100"filter="url(#ShiftAndBlur)" />

<text transform="translate(210,210)">

  PASS

</text>

</svg>

0