Bug 1244850 - always validate destination rect for CanvasRenderingContext2D::DrawImage. r=jmuizelaar

2016-02-02 12:45:17 -05:00 · 2016-02-02 12:45:17 -05:00 · 5522b98482
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@ -4374,8 +4374,8 @@ ClipImageDimension(double& aSourceCoord, double& aSourceSize, int32_t aImageSize

 // drawImage(in HTMLImageElement image, in float dx, in float dy);
 //   -- render image from 0,0 at dx,dy top-left coords
-// drawImage(in HTMLImageElement image, in float dx, in float dy, in float sw, in float sh);
-//   -- render image from 0,0 at dx,dy top-left coords clipping it to sw,sh
+// drawImage(in HTMLImageElement image, in float dx, in float dy, in float dw, in float dh);
+//   -- render image from 0,0 at dx,dy top-left coords clipping it to dw,dh
 // drawImage(in HTMLImageElement image, in float sx, in float sy, in float sw, in float sh, in float dx, in float dy, in float dw, in float dh);
 //   -- render the region defined by (sx,sy,sw,wh) in image-local space into the region (dx,dy,dw,dh) on the canvas

@ -4398,9 +4398,11 @@ CanvasRenderingContext2D::DrawImage(const CanvasImageSource& aImage,

  MOZ_ASSERT(aOptional_argc == 0 || aOptional_argc == 2 || aOptional_argc == 6);

+  if (!ValidateRect(aDx, aDy, aDw, aDh, true)) {
+    return;
+  }
  if (aOptional_argc == 6) {
-    if  (!ValidateRect(aSx, aSy, aSw, aSh, true) ||
-         !ValidateRect(aDx, aDy, aDw, aDh, true)) {
+    if (!ValidateRect(aSx, aSy, aSw, aSh, true)) {
      return;
    }
  }
--- a/dom/canvas/crashtests/1244850-1.html
+++ b/dom/canvas/crashtests/1244850-1.html
@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    var canvas = document.createElement('canvas');
+    var ctx = canvas.getContext('2d');
+    var svgImage = document.getElementsByTagName("img")[0];
+    ctx.drawImage(svgImage, 1e+308, 0);
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'><rect width='100' height='100' fill='blue'/></svg>">
+
+</body>
+</html>
--- a/dom/canvas/crashtests/crashtests.list
+++ b/dom/canvas/crashtests/crashtests.list
@ -28,4 +28,5 @@ load 1225381-1.html
 skip-if(azureCairo) load 1229983-1.html
 load 1229932-1.html
 load 1233613.html
+load 1244850-1.html
 load texImage2D.html