225574 2021-05-08 19:08:21 -0700 Add back protection of the pixel buffer in ImageBufferCGBackend::toCFData removed in r277237 2021-05-09 18:49:54 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 sam sam darin dino ews-watchlist graouts kondapallykalyan webkit-bug-importer oldest_to_newest 1758262 0 sam 2021-05-08 19:08:21 -0700 Add back protection of the pixel buffer in ImageBufferCGBackend::toCFData removed in r277237 1758267 1 428108 sam 2021-05-08 19:22:24 -0700 Created attachment 428108 Patch 1758271 2 428108 darin 2021-05-08 20:58:47 -0700 Comment on attachment 428108 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=428108&action=review > Source/WebCore/platform/graphics/cg/GraphicsContextGLCG.cpp:526 > + size_t dataSize = rowBytes * imageSize.height(); Not new: This computation is peculiar because it’s done as a 32-bit integer and then the results are put into a size_t. If it’s too big for 32-bits, it will overflow. > Source/WebCore/platform/graphics/cg/GraphicsContextGLCG.cpp:530 > + reinterpret_cast<ImageData*>(context)->deref(); Since this is void*, we can and should use static_cast instead of reinterpret_cast. > Source/WebCore/platform/graphics/cg/ImageBufferCGBackend.cpp:201 > + reinterpret_cast<ImageData*>(context)->deref(); Ditto. 1758407 3 ews-feeder 2021-05-09 18:48:17 -0700 Committed r277255 (237524@main): <https://commits.webkit.org/237524@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 428108. 1758408 4 webkit-bug-importer 2021-05-09 18:49:13 -0700 <rdar://problem/77723692> 1758409 5 sam 2021-05-09 18:49:54 -0700 (In reply to Darin Adler from comment #2) > Comment on attachment 428108 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=428108&action=review > > > Source/WebCore/platform/graphics/cg/GraphicsContextGLCG.cpp:526 > > + size_t dataSize = rowBytes * imageSize.height(); > > Not new: This computation is peculiar because it’s done as a 32-bit integer > and then the results are put into a size_t. If it’s too big for 32-bits, it > will overflow. I agree i's odd, but I don't believe it can overflow, since ImageData checks for that case in all its create functions and fails if it overflows. My guess about the size_t is that is what CGDataProviderCreateWithData takes and so someone was just matching types. > > > Source/WebCore/platform/graphics/cg/GraphicsContextGLCG.cpp:530 > > + reinterpret_cast<ImageData*>(context)->deref(); > > Since this is void*, we can and should use static_cast instead of > reinterpret_cast. > > > Source/WebCore/platform/graphics/cg/ImageBufferCGBackend.cpp:201 > > + reinterpret_cast<ImageData*>(context)->deref(); > > Ditto. Going to fix this in the next patch, where I touch this once again. 428108 2021-05-08 19:22:24 -0700 2021-05-09 18:48:17 -0700 Patch bug-225574-20210508192223.patch text/plain 6043 sam SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI3NzIzNykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI5IEBACisyMDIxLTA1LTA4ICBTYW0gV2Vp bmlnICA8d2VpbmlnQGFwcGxlLmNvbT4KKworICAgICAgICBBZGQgYmFjayBwcm90ZWN0aW9uIG9m IHRoZSBwaXhlbCBidWZmZXIgaW4gSW1hZ2VCdWZmZXJDR0JhY2tlbmQ6OnRvQ0ZEYXRhIHJlbW92 ZWQgaW4gcjI3NzIzNworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MjI1NTc0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgSW4gcjI3NzIzNywgSSBhY2NpZGVudGFsbHkgcmVtb3ZlZCBhIGBSZWZQdHI8VWludDhD bGFtcGVkQXJyYXk+IHByb3RlY3RlZFBpeGVsQXJyYXlgCisgICAgICAgIGluIEltYWdlQnVmZmVy Q0dCYWNrZW5kOjp0b0NGRGF0YSB0aGF0IHdhcyBuZWVkZWQgdG8gYXZvaWRlZCBjcmFzaGluZyBp biBzb21lIGNhc2VzCisgICAgICAgIHdoZW4gcnVubmluZyBmYXN0L2NhbnZhcy9jYW52YXMtdG9E YXRhVVJMLWpwZWctY3Jhc2guaHRtbC4KKworICAgICAgICBTaW5jZSBpdCB3YXNuJ3Qgc3VwZXIg Y2xlYXIgd2hhdCBpdCB3YXMgZG9pbmcsIHRoaXMgc3dpdGNoZXMgdG8gdXNpbmcgdGhlIG1vcmUg aWRpb21hdGljCisgICAgICAgIG1ldGhvZCBvZiBrZWVwaW5nIHRoZSBkYXRhIGFsaXZlIGluIGEg Q0dEYXRhUHJvdmlkZXJSZWYgYnkgcGFzc2luZyB0aGUgbGVha2VkIGltYWdlIGRhdGEKKyAgICAg ICAgYXMgdGhlIGNvbnRleHQgYW5kIGRlcmVmaW5nIGluIHRoZSBjYWxsYmFjayBsYW1iZGEuCisK KyAgICAgICAgSnVzdCB0byBiZSBjb25zaXN0ZW50LCBJIHdlbnQgdG8gb3RoZXIgY2FsbGVycyBv ZiBDR0RhdGFQcm92aWRlckNyZWF0ZVdpdGhEYXRhIGFuZAorICAgICAgICB1cGRhdGVkIHRoZW0g dG8gYmUgaWRpb21hdGljYWxseSBjb25zaXN0ZW50LgorCisgICAgICAgICogcGxhdGZvcm0vZ3Jh cGhpY3MvY2cvR3JhcGhpY3NDb250ZXh0R0xDRy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpHcmFw aGljc0NvbnRleHRHTE9wZW5HTDo6cGFpbnRUb0NhbnZhcyk6CisgICAgICAgIChXZWJDb3JlOjpy ZWxlYXNlSW1hZ2VEYXRhKTogRGVsZXRlZC4KKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9j Zy9JbWFnZUJ1ZmZlckNHQmFja2VuZC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpJbWFnZUJ1ZmZl ckNHQmFja2VuZDo6dG9DRkRhdGEgY29uc3QpOgorICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNz L2NnL0ltYWdlQnVmZmVyQ0dCaXRtYXBCYWNrZW5kLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6Oklt YWdlQnVmZmVyQ0dCaXRtYXBCYWNrZW5kOjpjcmVhdGUpOgorCiAyMDIxLTA1LTA4ICBTYW0gV2Vp bmlnICA8d2VpbmlnQGFwcGxlLmNvbT4KIAogICAgICAgICBGYWN0b3Igb3V0IHBpeGVsIGJ1ZmZl ciBmcm9tIERPTSBzcGVjaWZpYyBJbWFnZURhdGEgY2xhc3MKSW5kZXg6IFNvdXJjZS9XZWJDb3Jl L3BsYXRmb3JtL2dyYXBoaWNzL2NnL0dyYXBoaWNzQ29udGV4dEdMQ0cuY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2NnL0dyYXBoaWNzQ29udGV4dEdM Q0cuY3BwCShyZXZpc2lvbiAyNzcyMzcpCisrKyBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFw aGljcy9jZy9HcmFwaGljc0NvbnRleHRHTENHLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTA2LDEx ICs1MDYsNiBAQCBib29sIEdyYXBoaWNzQ29udGV4dEdMSW1hZ2VFeHRyYWN0b3I6OmV4CiAgICAg cmV0dXJuIHRydWU7CiB9CiAKLXN0YXRpYyB2b2lkIHJlbGVhc2VJbWFnZURhdGEodm9pZCogaW1h Z2VEYXRhLCBjb25zdCB2b2lkKiwgc2l6ZV90KQotewotICAgIHJlaW50ZXJwcmV0X2Nhc3Q8SW1h Z2VEYXRhKj4oaW1hZ2VEYXRhKS0+ZGVyZWYoKTsKLX0KLQogdm9pZCBHcmFwaGljc0NvbnRleHRH TE9wZW5HTDo6cGFpbnRUb0NhbnZhcyhjb25zdCBHcmFwaGljc0NvbnRleHRHTEF0dHJpYnV0ZXMm IHNvdXJjZUNvbnRleHRBdHRyaWJ1dGVzLCBSZWY8SW1hZ2VEYXRhPiYmIGltYWdlRGF0YSwgY29u c3QgSW50U2l6ZSYgY2FudmFzU2l6ZSwgR3JhcGhpY3NDb250ZXh0JiBjb250ZXh0KQogewogICAg IEFTU0VSVCghaW1hZ2VEYXRhLT5zaXplKCkuaXNFbXB0eSgpKTsKQEAgLTUyOCwxMyArNTIzLDE0 IEBAIHZvaWQgR3JhcGhpY3NDb250ZXh0R0xPcGVuR0w6OnBhaW50VG9DYW4KIAogICAgIGF1dG8g aW1hZ2VTaXplID0gaW1hZ2VEYXRhLT5zaXplKCk7CiAgICAgaW50IHJvd0J5dGVzID0gaW1hZ2VT aXplLndpZHRoKCkgKiA0OwotICAgICAgICBzaXplX3QgZGF0YVNpemUgPSByb3dCeXRlcyAqIGlt YWdlU2l6ZS5oZWlnaHQoKTsKKyAgICBzaXplX3QgZGF0YVNpemUgPSByb3dCeXRlcyAqIGltYWdl U2l6ZS5oZWlnaHQoKTsKICAgICB1aW50OF90KiBpbWFnZVBpeGVscyA9IGltYWdlRGF0YS0+ZGF0 YSgpLmRhdGEoKTsKLSAgICAgICAgdmVyaWZ5SW1hZ2VCdWZmZXJJc0JpZ0Vub3VnaChpbWFnZVBp eGVscywgZGF0YVNpemUpOwotICAgIFJldGFpblB0cjxDR0RhdGFQcm92aWRlclJlZj4gZGF0YVBy b3ZpZGVyID0gYWRvcHRDRihDR0RhdGFQcm92aWRlckNyZWF0ZVdpdGhEYXRhKCZpbWFnZURhdGEu bGVha1JlZigpLCBpbWFnZVBpeGVscywgZGF0YVNpemUsIHJlbGVhc2VJbWFnZURhdGEpKTsKKyAg ICB2ZXJpZnlJbWFnZUJ1ZmZlcklzQmlnRW5vdWdoKGltYWdlUGl4ZWxzLCBkYXRhU2l6ZSk7Cisg ICAgYXV0byBkYXRhUHJvdmlkZXIgPSBhZG9wdENGKENHRGF0YVByb3ZpZGVyQ3JlYXRlV2l0aERh dGEoJmltYWdlRGF0YS5sZWFrUmVmKCksIGltYWdlUGl4ZWxzLCBkYXRhU2l6ZSwgW10gKHZvaWQq IGNvbnRleHQsIGNvbnN0IHZvaWQqLCBzaXplX3QpIHsKKyAgICAgICAgcmVpbnRlcnByZXRfY2Fz dDxJbWFnZURhdGEqPihjb250ZXh0KS0+ZGVyZWYoKTsKKyAgICB9KSk7CiAKLSAgICBhdXRvIGlt YWdlID0gTmF0aXZlSW1hZ2U6OmNyZWF0ZShhZG9wdENGKENHSW1hZ2VDcmVhdGUoaW1hZ2VTaXpl LndpZHRoKCksIGltYWdlU2l6ZS5oZWlnaHQoKSwgOCwgMzIsIHJvd0J5dGVzLCBzUkdCQ29sb3JT cGFjZVJlZigpLCBiaXRtYXBJbmZvLAotICAgICAgICBkYXRhUHJvdmlkZXIuZ2V0KCksIDAsIGZh bHNlLCBrQ0dSZW5kZXJpbmdJbnRlbnREZWZhdWx0KSkpOworICAgIGF1dG8gaW1hZ2UgPSBOYXRp dmVJbWFnZTo6Y3JlYXRlKGFkb3B0Q0YoQ0dJbWFnZUNyZWF0ZShpbWFnZVNpemUud2lkdGgoKSwg aW1hZ2VTaXplLmhlaWdodCgpLCA4LCAzMiwgcm93Qnl0ZXMsIHNSR0JDb2xvclNwYWNlUmVmKCks IGJpdG1hcEluZm8sIGRhdGFQcm92aWRlci5nZXQoKSwgMCwgZmFsc2UsIGtDR1JlbmRlcmluZ0lu dGVudERlZmF1bHQpKSk7CiAKICAgICAvLyBDU1Mgc3R5bGluZyBtYXkgY2F1c2UgdGhlIGNhbnZh cydzIGNvbnRlbnQgdG8gYmUgcmVzaXplZCBvbgogICAgIC8vIHRoZSBwYWdlLiBHbyBiYWNrIHRv IHRoZSBDYW52YXMgdG8gZmlndXJlIG91dCB0aGUgY29ycmVjdApJbmRleDogU291cmNlL1dlYkNv cmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2cvSW1hZ2VCdWZmZXJDR0JhY2tlbmQuY3BwCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2NnL0ltYWdlQnVmZmVyQ0dC YWNrZW5kLmNwcAkocmV2aXNpb24gMjc3MjM3KQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0v Z3JhcGhpY3MvY2cvSW1hZ2VCdWZmZXJDR0JhY2tlbmQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0x OTEsMTIgKzE5MSwxNiBAQCBSZXRhaW5QdHI8Q0ZEYXRhUmVmPiBJbWFnZUJ1ZmZlckNHQmFja2Vu CiAgICAgICAgIGlmICghaW1hZ2VEYXRhKQogICAgICAgICAgICAgcmV0dXJuIG51bGxwdHI7CiAK LSAgICAgICAgYXV0byBwcm90ZWN0ZWRQaXhlbEFycmF5ID0gbWFrZVJlZihpbWFnZURhdGEtPmRh dGEoKSk7Ci0gICAgICAgIHNpemVfdCBkYXRhU2l6ZSA9IHByb3RlY3RlZFBpeGVsQXJyYXktPmJ5 dGVMZW5ndGgoKTsKLSAgICAgICAgSW50U2l6ZSBwaXhlbEFycmF5RGltZW5zaW9ucyA9IGltYWdl RGF0YS0+c2l6ZSgpOwotCi0gICAgICAgIHZlcmlmeUltYWdlQnVmZmVySXNCaWdFbm91Z2gocHJv dGVjdGVkUGl4ZWxBcnJheS0+ZGF0YSgpLCBkYXRhU2l6ZSk7Ci0gICAgICAgIGF1dG8gZGF0YVBy b3ZpZGVyID0gYWRvcHRDRihDR0RhdGFQcm92aWRlckNyZWF0ZVdpdGhEYXRhKG51bGxwdHIsIHBy b3RlY3RlZFBpeGVsQXJyYXktPmRhdGEoKSwgZGF0YVNpemUsIG51bGxwdHIpKTsKKyAgICAgICAg YXV0byYgcGl4ZWxBcnJheSA9IGltYWdlRGF0YS0+ZGF0YSgpOworICAgICAgICBhdXRvIGRhdGFT aXplID0gcGl4ZWxBcnJheS5ieXRlTGVuZ3RoKCk7CisgICAgICAgIGF1dG8gcGl4ZWxBcnJheURp bWVuc2lvbnMgPSBpbWFnZURhdGEtPnNpemUoKTsKKworICAgICAgICB2ZXJpZnlJbWFnZUJ1ZmZl cklzQmlnRW5vdWdoKHBpeGVsQXJyYXkuZGF0YSgpLCBkYXRhU2l6ZSk7CisKKyAgICAgICAgYXV0 byBkYXRhUHJvdmlkZXIgPSBhZG9wdENGKENHRGF0YVByb3ZpZGVyQ3JlYXRlV2l0aERhdGEoaW1h Z2VEYXRhLmxlYWtSZWYoKSwgcGl4ZWxBcnJheS5kYXRhKCksIGRhdGFTaXplLCBbXSAodm9pZCog Y29udGV4dCwgY29uc3Qgdm9pZCosIHNpemVfdCkgeworICAgICAgICAgICAgcmVpbnRlcnByZXRf Y2FzdDxJbWFnZURhdGEqPihjb250ZXh0KS0+ZGVyZWYoKTsKKyAgICAgICAgfSkpOworICAgICAg ICAKICAgICAgICAgaWYgKCFkYXRhUHJvdmlkZXIpCiAgICAgICAgICAgICByZXR1cm4gbnVsbHB0 cjsKIApJbmRleDogU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2cvSW1hZ2VCdWZm ZXJDR0JpdG1hcEJhY2tlbmQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BsYXRm b3JtL2dyYXBoaWNzL2NnL0ltYWdlQnVmZmVyQ0dCaXRtYXBCYWNrZW5kLmNwcAkocmV2aXNpb24g Mjc3MjM3KQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2cvSW1hZ2VCdWZm ZXJDR0JpdG1hcEJhY2tlbmQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC04NywxMSArODcsOSBAQCBz dGQ6OnVuaXF1ZV9wdHI8SW1hZ2VCdWZmZXJDR0JpdG1hcEJhY2tlCiAKICAgICBhdXRvIGNvbnRl eHQgPSBtYWtlVW5pcXVlPEdyYXBoaWNzQ29udGV4dD4oY2dDb250ZXh0LmdldCgpKTsKIAotICAg IGNvbnN0IGF1dG8gcmVsZWFzZUltYWdlRGF0YSA9IFtdICh2b2lkKiwgY29uc3Qgdm9pZCogZGF0 YSwgc2l6ZV90KSB7CisgICAgYXV0byBkYXRhUHJvdmlkZXIgPSBhZG9wdENGKENHRGF0YVByb3Zp ZGVyQ3JlYXRlV2l0aERhdGEobnVsbHB0ciwgZGF0YSwgbnVtQnl0ZXMsIFtdICh2b2lkKiwgY29u c3Qgdm9pZCogZGF0YSwgc2l6ZV90KSB7CiAgICAgICAgIGZhc3RGcmVlKGNvbnN0X2Nhc3Q8dm9p ZCo+KGRhdGEpKTsKLSAgICB9OwotCi0gICAgYXV0byBkYXRhUHJvdmlkZXIgPSBhZG9wdENGKENH RGF0YVByb3ZpZGVyQ3JlYXRlV2l0aERhdGEoMCwgZGF0YSwgbnVtQnl0ZXMsIHJlbGVhc2VJbWFn ZURhdGEpKTsKKyAgICB9KSk7CiAKICAgICByZXR1cm4gc3RkOjp1bmlxdWVfcHRyPEltYWdlQnVm ZmVyQ0dCaXRtYXBCYWNrZW5kPihuZXcgSW1hZ2VCdWZmZXJDR0JpdG1hcEJhY2tlbmQocGFyYW1l dGVycywgZGF0YSwgV1RGTW92ZShkYXRhUHJvdmlkZXIpLCBXVEZNb3ZlKGNvbnRleHQpKSk7CiB9 Cg==