Bug 159958 - out-of-bounds write in DrawToImage. r=pedemonte, sr=brendan

gfx/src/gtk/nsImageGTK.cpp

@@ -2009,9 +2009,9 @@ NS_IMETHODIMP nsImageGTK::DrawToImage(nsIImage* aDstImage,
           else {
             dstAlpha[(aDX+x)>>3]       |= alphaPixels >> offset;
             // avoid write if no 1's to write - also avoids going past end of array
-            // compiler should merge the common sub-expressions
-            if (alphaPixels << (8U - offset))
-              dstAlpha[((aDX+x)>>3) + 1] |= alphaPixels << (8U - offset);
+            PRUint8 alphaTemp = alphaPixels << (8U - offset);
+            if (alphaTemp & 0xff)
+              dstAlpha[((aDX+x)>>3) + 1] |= alphaTemp;
           }
           
           if (alphaPixels == 0xff) {

gfx/src/windows/nsImageWin.cpp

@@ -1883,9 +1883,9 @@ NS_IMETHODIMP nsImageWin::DrawToImage(nsIImage* aDstImage, nscoord aDX, nscoord
             } else {
               dstAlpha[(aDX+x)>>3]       |= alphaPixels >> offset;
               // avoid write if no 1's to write - also avoids going past end of array
-              // compiler should merge the common sub-expressions
-              if (alphaPixels << (8U - offset))
-                dstAlpha[((aDX+x)>>3) + 1] |= alphaPixels << (8U - offset);
+              PRUint8 alphaTemp = alphaPixels << (8U - offset);
+              if (alphaTemp & 0xff)
+                dstAlpha[((aDX+x)>>3) + 1] |= alphaTemp;
             }
 
 

gfx/src/xlib/nsImageXlib.cpp

@@ -1602,9 +1602,9 @@ NS_IMETHODIMP nsImageXlib::DrawToImage(nsIImage* aDstImage,
           else {
             dstAlpha[(aDX+x)>>3]       |= alphaPixels >> offset;
             // avoid write if no 1's to write - also avoids going past end of array
-            // compiler should merge the common sub-expressions
-            if (alphaPixels << (8U - offset))
-              dstAlpha[((aDX+x)>>3) + 1] |= alphaPixels << (8U - offset);
+            PRUint8 alphaTemp = alphaPixels << (8U - offset);
+            if (alphaTemp & 0xff)
+              dstAlpha[((aDX+x)>>3) + 1] |= alphaTemp;
           }
 
           if (alphaPixels == 0xff) {