зеркало из https://github.com/mozilla/pjs.git
Bug 392751 - Allow out of bounds rects in getImageData; r=bz
This commit is contained in:
Saint Wesonga ext:(%2C%20Ms2ger%20%3Cms2ger%40gmail.com%3E)
Родитель
7f5f9fd7a5
Коммит
b730e4c75b
|
|
@ -3845,32 +3845,51 @@ nsCanvasRenderingContext2D::GetImageData_explicit(PRInt32 x, PRInt32 y, PRUint32
|
|||
return NS_ERROR_DOM_SECURITY_ERR;
|
||||
}
|
||||
|
||||
if (w == 0 || h == 0)
|
||||
if (w == 0 || h == 0 || aDataLen != w * h * 4)
|
||||
return NS_ERROR_DOM_SYNTAX_ERR;
|
||||
|
||||
if (!CanvasUtils::CheckSaneSubrectSize (x, y, w, h, mWidth, mHeight))
|
||||
return NS_ERROR_DOM_SYNTAX_ERR;
|
||||
CheckedInt32 rightMost = CheckedInt32(x) + w;
|
||||
CheckedInt32 bottomMost = CheckedInt32(y) + h;
|
||||
|
||||
PRUint32 len = w * h * 4;
|
||||
if (aDataLen != len)
|
||||
if (!rightMost.valid() || !bottomMost.valid())
|
||||
return NS_ERROR_DOM_SYNTAX_ERR;
|
||||
|
||||
/* Copy the surface contents to the buffer */
|
||||
nsRefPtr<gfxImageSurface> tmpsurf = new gfxImageSurface(aData,
|
||||
gfxIntSize(w, h),
|
||||
w * 4,
|
||||
gfxASurface::ImageFormatARGB32);
|
||||
if (!tmpsurf || tmpsurf->CairoStatus())
|
||||
nsRefPtr<gfxImageSurface> tmpsurf =
|
||||
new gfxImageSurface(aData,
|
||||
gfxIntSize(w, h),
|
||||
w * 4,
|
||||
gfxASurface::ImageFormatARGB32);
|
||||
|
||||
if (tmpsurf->CairoStatus())
|
||||
return NS_ERROR_FAILURE;
|
||||
|
||||
nsRefPtr<gfxContext> tmpctx = new gfxContext(tmpsurf);
|
||||
|
||||
if (!tmpctx || tmpctx->HasError())
|
||||
if (tmpctx->HasError())
|
||||
return NS_ERROR_FAILURE;
|
||||
|
||||
tmpctx->SetOperator(gfxContext::OPERATOR_SOURCE);
|
||||
tmpctx->SetSource(mSurface, gfxPoint(-(int)x, -(int)y));
|
||||
tmpctx->Paint();
|
||||
gfxRect srcRect(0, 0, mWidth, mHeight);
|
||||
gfxRect destRect(x, y, w, h);
|
||||
|
||||
bool finishedPainting = false;
|
||||
// In the common case, we want to avoid the Rectangle call.
|
||||
if (!srcRect.Contains(destRect)) {
|
||||
// If the requested area is entirely outside the canvas, we're done.
|
||||
gfxRect tmp = srcRect.Intersect(destRect);
|
||||
finishedPainting = tmp.IsEmpty();
|
||||
|
||||
// Set clipping region if necessary.
|
||||
if (!finishedPainting) {
|
||||
tmpctx->Rectangle(tmp);
|
||||
}
|
||||
}
|
||||
|
||||
if (!finishedPainting) {
|
||||
tmpctx->SetOperator(gfxContext::OPERATOR_SOURCE);
|
||||
tmpctx->SetSource(mSurface, gfxPoint(-x, -y));
|
||||
tmpctx->Paint();
|
||||
}
|
||||
|
||||
// make sure sUnpremultiplyTable has been created
|
||||
EnsureUnpremultiplyTable();
|
||||
|
|
|
|||
|
|
@ -7957,19 +7957,15 @@ ctx.fillRect(0, 0, 100, 50);
|
|||
ctx.fillStyle = '#fff';
|
||||
ctx.fillRect(20, 10, 60, 10);
|
||||
|
||||
try {
|
||||
var imgdata1 = ctx.getImageData(85, 25, -10, -10);
|
||||
ok(imgdata1.data[0] === 255, "imgdata1.data[\""+(0)+"\"] === 255");
|
||||
ok(imgdata1.data[1] === 255, "imgdata1.data[\""+(1)+"\"] === 255");
|
||||
ok(imgdata1.data[2] === 255, "imgdata1.data[\""+(2)+"\"] === 255");
|
||||
ok(imgdata1.data[3] === 255, "imgdata1.data[\""+(3)+"\"] === 255");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+0] === 0, "imgdata1.data[imgdata1.data.length-4+0] === 0");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+1] === 0, "imgdata1.data[imgdata1.data.length-4+1] === 0");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+2] === 0, "imgdata1.data[imgdata1.data.length-4+2] === 0");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+3] === 255, "imgdata1.data[imgdata1.data.length-4+3] === 255");
|
||||
} catch (e) {
|
||||
ok(false, "Unexpected exception in first part of test_2d_imageData_get_source_negative()", e);
|
||||
}
|
||||
var imgdata1 = ctx.getImageData(85, 25, -10, -10);
|
||||
ok(imgdata1.data[0] === 255, "imgdata1.data[\""+(0)+"\"] === 255");
|
||||
ok(imgdata1.data[1] === 255, "imgdata1.data[\""+(1)+"\"] === 255");
|
||||
ok(imgdata1.data[2] === 255, "imgdata1.data[\""+(2)+"\"] === 255");
|
||||
ok(imgdata1.data[3] === 255, "imgdata1.data[\""+(3)+"\"] === 255");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+0] === 0, "imgdata1.data[imgdata1.data.length-4+0] === 0");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+1] === 0, "imgdata1.data[imgdata1.data.length-4+1] === 0");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+2] === 0, "imgdata1.data[imgdata1.data.length-4+2] === 0");
|
||||
ok(imgdata1.data[imgdata1.data.length-4+3] === 255, "imgdata1.data[imgdata1.data.length-4+3] === 255");
|
||||
|
||||
var imgdata2 = ctx.getImageData(0, 0, -1, -1);
|
||||
ok(imgdata2.data[0] === 0, "imgdata2.data[\""+(0)+"\"] === 0");
|
||||
|
|
@ -7980,7 +7976,7 @@ ok(imgdata2.data[3] === 0, "imgdata2.data[\""+(3)+"\"] === 0");
|
|||
} catch (e) {
|
||||
_thrown_outer = true;
|
||||
}
|
||||
todo(!_thrown_outer, 'should not throw exception');
|
||||
ok(!_thrown_outer, 'should not throw exception');
|
||||
|
||||
|
||||
}
|
||||
|
|
@ -8028,10 +8024,44 @@ ok(imgdata4.data[1] === 0, "imgdata4.data[\""+(1)+"\"] === 0");
|
|||
ok(imgdata4.data[2] === 0, "imgdata4.data[\""+(2)+"\"] === 0");
|
||||
ok(imgdata4.data[3] === 0, "imgdata4.data[\""+(3)+"\"] === 0");
|
||||
|
||||
var imgdata5 = ctx.getImageData(100, 10, 1, 1);
|
||||
ok(imgdata5.data[0] === 0, "imgdata5.data[\""+(0)+"\"] === 0");
|
||||
ok(imgdata5.data[1] === 0, "imgdata5.data[\""+(1)+"\"] === 0");
|
||||
ok(imgdata5.data[2] === 0, "imgdata5.data[\""+(2)+"\"] === 0");
|
||||
ok(imgdata5.data[3] === 0, "imgdata5.data[\""+(3)+"\"] === 0");
|
||||
|
||||
var imgdata6 = ctx.getImageData(0, 10, 1, 1);
|
||||
ok(imgdata6.data[0] === 0, "imgdata6.data[\""+(0)+"\"] === 0");
|
||||
ok(imgdata6.data[1] === 136, "imgdata6.data[\""+(1)+"\"] === 136");
|
||||
ok(imgdata6.data[2] === 255, "imgdata6.data[\""+(2)+"\"] === 255");
|
||||
ok(imgdata6.data[3] === 255, "imgdata6.data[\""+(3)+"\"] === 255");
|
||||
|
||||
var imgdata7 = ctx.getImageData(-10, 10, 20, 20);
|
||||
ok(imgdata7.data[ 0*4+0] === 0, "imgdata7.data[ 0*4+0] === 0");
|
||||
ok(imgdata7.data[ 0*4+1] === 0, "imgdata7.data[ 0*4+1] === 0");
|
||||
ok(imgdata7.data[ 0*4+2] === 0, "imgdata7.data[ 0*4+2] === 0");
|
||||
ok(imgdata7.data[ 0*4+3] === 0, "imgdata7.data[ 0*4+3] === 0");
|
||||
ok(imgdata7.data[ 9*4+0] === 0, "imgdata7.data[ 9*4+0] === 0");
|
||||
ok(imgdata7.data[ 9*4+1] === 0, "imgdata7.data[ 9*4+1] === 0");
|
||||
ok(imgdata7.data[ 9*4+2] === 0, "imgdata7.data[ 9*4+2] === 0");
|
||||
ok(imgdata7.data[ 9*4+3] === 0, "imgdata7.data[ 9*4+3] === 0");
|
||||
ok(imgdata7.data[10*4+0] === 0, "imgdata7.data[10*4+0] === 0");
|
||||
ok(imgdata7.data[10*4+1] === 136, "imgdata7.data[10*4+1] === 136");
|
||||
ok(imgdata7.data[10*4+2] === 255, "imgdata7.data[10*4+2] === 255");
|
||||
ok(imgdata7.data[10*4+3] === 255, "imgdata7.data[10*4+3] === 255");
|
||||
ok(imgdata7.data[19*4+0] === 0, "imgdata7.data[19*4+0] === 0");
|
||||
ok(imgdata7.data[19*4+1] === 136, "imgdata7.data[19*4+1] === 136");
|
||||
ok(imgdata7.data[19*4+2] === 255, "imgdata7.data[19*4+2] === 255");
|
||||
ok(imgdata7.data[19*4+3] === 255, "imgdata7.data[19*4+3] === 255");
|
||||
ok(imgdata7.data[20*4+0] === 0, "imgdata7.data[20*4+0] === 0");
|
||||
ok(imgdata7.data[20*4+1] === 0, "imgdata7.data[20*4+1] === 0");
|
||||
ok(imgdata7.data[20*4+2] === 0, "imgdata7.data[20*4+2] === 0");
|
||||
ok(imgdata7.data[20*4+3] === 0, "imgdata7.data[20*4+3] === 0");
|
||||
|
||||
} catch (e) {
|
||||
_thrown_outer = true;
|
||||
}
|
||||
todo(!_thrown_outer, 'should not throw exception');
|
||||
ok(!_thrown_outer, 'should not throw exception');
|
||||
|
||||
|
||||
}
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче