From f87d25ee403c69d4f19a910d7b18f96dd3da8d51 Mon Sep 17 00:00:00 2001 From: Dan Glastonbury Date: Tue, 20 Feb 2018 16:16:10 -0500 Subject: Bug 1428947 - Check plane width & stride constraints. r=mattwoodrow, a=ritu MozReview-Commit-ID: 328ETwMdVnq --HG-- extra : rebase_source : e16b28d137de080f9d8495c6937e24ac16b16ab1 --- gfx/layers/ImageContainer.cpp | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) (limited to 'gfx/layers') diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp index 8072e0401..5e4019e86 100644 --- a/gfx/layers/ImageContainer.cpp +++ b/gfx/layers/ImageContainer.cpp @@ -438,12 +438,15 @@ static void CopyPlane(uint8_t *aDst, const uint8_t *aSrc, const gfx::IntSize &aSize, int32_t aStride, int32_t aSkip) { + int32_t height = aSize.height; + int32_t width = aSize.width; + + MOZ_RELEASE_ASSERT(width <= aStride); + if (!aSkip) { // Fast path: planar input. - memcpy(aDst, aSrc, aSize.height * aStride); + memcpy(aDst, aSrc, height * aStride); } else { - int32_t height = aSize.height; - int32_t width = aSize.width; for (int y = 0; y < height; ++y) { const uint8_t *src = aSrc; uint8_t *dst = aDst; @@ -461,13 +464,11 @@ CopyPlane(uint8_t *aDst, const uint8_t *aSrc, bool RecyclingPlanarYCbCrImage::CopyData(const Data& aData) { - mData = aData; - // update buffer size // Use uint32_t throughout to match AllocateBuffer's param and mBufferSize const auto checkedSize = - CheckedInt(mData.mCbCrStride) * mData.mCbCrSize.height * 2 + - CheckedInt(mData.mYStride) * mData.mYSize.height; + CheckedInt(aData.mCbCrStride) * aData.mCbCrSize.height * 2 + + CheckedInt(aData.mYStride) * aData.mYSize.height; if (!checkedSize.isValid()) return false; @@ -482,16 +483,18 @@ RecyclingPlanarYCbCrImage::CopyData(const Data& aData) // update buffer size mBufferSize = size; + mData = aData; mData.mYChannel = mBuffer.get(); mData.mCbChannel = mData.mYChannel + mData.mYStride * mData.mYSize.height; mData.mCrChannel = mData.mCbChannel + mData.mCbCrStride * mData.mCbCrSize.height; + mData.mYSkip = mData.mCbSkip = mData.mCrSkip = 0; CopyPlane(mData.mYChannel, aData.mYChannel, - mData.mYSize, mData.mYStride, mData.mYSkip); + aData.mYSize, aData.mYStride, aData.mYSkip); CopyPlane(mData.mCbChannel, aData.mCbChannel, - mData.mCbCrSize, mData.mCbCrStride, mData.mCbSkip); + aData.mCbCrSize, aData.mCbCrStride, aData.mCbSkip); CopyPlane(mData.mCrChannel, aData.mCrChannel, - mData.mCbCrSize, mData.mCbCrStride, mData.mCrSkip); + aData.mCbCrSize, aData.mCbCrStride, aData.mCrSkip); mSize = aData.mPicSize; mOrigin = gfx::IntPoint(aData.mPicX, aData.mPicY); -- cgit v1.2.3