Bug 1816140: Check that OffscreenCanvas width and height fit in int32_t. r=gfx-reviewers,webidl,aosmond,nical,smaug

Differential Revision: https://phabricator.services.mozilla.com/D169508
2023-02-14 00:18:37 +00:00 · 2023-02-14 00:18:37 +00:00 · 28e244c4c1
--- a/dom/canvas/OffscreenCanvas.cpp
+++ b/dom/canvas/OffscreenCanvas.cpp
@ -7,6 +7,7 @@
 #include "OffscreenCanvas.h"

 #include "mozilla/Atomics.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/dom/BlobImpl.h"
 #include "mozilla/dom/OffscreenCanvasBinding.h"
 #include "mozilla/dom/OffscreenCanvasDisplayHelper.h"
@ -67,7 +68,25 @@ JSObject* OffscreenCanvas::WrapObject(JSContext* aCx,

 /* static */
 already_AddRefed<OffscreenCanvas> OffscreenCanvas::Constructor(
-    const GlobalObject& aGlobal, uint32_t aWidth, uint32_t aHeight) {
+    const GlobalObject& aGlobal, uint32_t aWidth, uint32_t aHeight,
+    ErrorResult& aRv) {
+  // CanvasRenderingContextHelper::GetWidthHeight wants us to return
+  // an nsIntSize, so make sure that that will work.
+  if (!CheckedInt<int32_t>(aWidth).isValid()) {
+    aRv.ThrowRangeError(
+        nsPrintfCString("OffscreenCanvas width %u is out of range: must be no "
+                        "greater than 2147483647.",
+                        aWidth));
+    return nullptr;
+  }
+  if (!CheckedInt<int32_t>(aHeight).isValid()) {
+    aRv.ThrowRangeError(
+        nsPrintfCString("OffscreenCanvas height %u is out of range: must be no "
+                        "greater than 2147483647.",
+                        aHeight));
+    return nullptr;
+  }
+
  nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aGlobal.GetAsSupports());
  RefPtr<OffscreenCanvas> offscreenCanvas = new OffscreenCanvas(
      global, aWidth, aHeight, layers::LayersBackend::LAYERS_NONE,
@ -82,6 +101,16 @@ void OffscreenCanvas::SetWidth(uint32_t aWidth, ErrorResult& aRv) {
    return;
  }

+  // CanvasRenderingContextHelper::GetWidthHeight wants us to return
+  // an nsIntSize, so make sure that that will work.
+  if (!CheckedInt<int32_t>(aWidth).isValid()) {
+    aRv.ThrowRangeError(
+        nsPrintfCString("OffscreenCanvas width %u is out of range: must be no "
+                        "greater than 2147483647.",
+                        aWidth));
+    return;
+  }
+
  mWidth = aWidth;
  CanvasAttrChanged();
 }
@ -93,6 +122,16 @@ void OffscreenCanvas::SetHeight(uint32_t aHeight, ErrorResult& aRv) {
    return;
  }

+  // CanvasRenderingContextHelper::GetWidthHeight wants us to return
+  // an nsIntSize, so make sure that that will work.
+  if (!CheckedInt<int32_t>(aHeight).isValid()) {
+    aRv.ThrowRangeError(
+        nsPrintfCString("OffscreenCanvas height %u is out of range: must be no "
+                        "greater than 2147483647.",
+                        aHeight));
+    return;
+  }
+
  mHeight = aHeight;
  CanvasAttrChanged();
 }
--- a/dom/canvas/OffscreenCanvas.h
+++ b/dom/canvas/OffscreenCanvas.h
@ -80,7 +80,8 @@ class OffscreenCanvas final : public DOMEventTargetHelper,
                               JS::Handle<JSObject*> aGivenProto) override;

  static already_AddRefed<OffscreenCanvas> Constructor(
-      const GlobalObject& aGlobal, uint32_t aWidth, uint32_t aHeight);
+      const GlobalObject& aGlobal, uint32_t aWidth, uint32_t aHeight,
+      ErrorResult& aRv);

  void ClearResources();

--- a/dom/canvas/crashtests/1816140.html
+++ b/dom/canvas/crashtests/1816140.html
@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      window.addEventListener("load", async () => {
+        const adapter = await navigator.gpu.requestAdapter({})
+        const device = await adapter.requestDevice({})
+        const canvas = new OffscreenCanvas(184, 4266759736)
+        context = canvas.getContext('webgpu')
+        context.configure({
+          device: device,
+          format: context.getPreferredFormat(adapter),
+        })
+      })
+    </script>
+</head>
+</html>
--- a/dom/canvas/crashtests/crashtests.list
+++ b/dom/canvas/crashtests/crashtests.list
@ -64,3 +64,4 @@ load 1757925-1.html
 load 1757755.html
 pref(gfx.offscreencanvas.enabled,true) load 1769878.html
 pref(gfx.offscreencanvas.enabled,true) load 1771007-1.html
+pref(dom.webgpu.enabled,true) load 1816140.html
--- a/dom/webidl/OffscreenCanvas.webidl
+++ b/dom/webidl/OffscreenCanvas.webidl
@ -18,6 +18,7 @@ enum OffscreenRenderingContextId { "2d", "bitmaprenderer", "webgl", "webgl2", "w

 [Exposed=(Window,Worker), Pref="gfx.offscreencanvas.enabled"]
 interface OffscreenCanvas : EventTarget {
+  [Throws]
  constructor([EnforceRange] unsigned long width, [EnforceRange] unsigned long height);

  [Pure, SetterThrows]