Attachment 273528 Details for Bug 111179 – Patch

[patch] Patch

bug-111179-20160309190810.patch (text/plain), 2.52 KB, created by Martin Robinson on 2016-03-09 19:08:23 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Robinson

Created: 2016-03-09 19:08:23 PST

Size: 2.52 KB

patch

obsolete

>Subversion Revision: 196772
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index a1f20acca9e35c8ad222af0af608e62a658c8487..b8aa7a22cbbe53455af8d33088788b517b221f7d 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,24 @@
>+2016-03-07  Martin Robinson  <mrobinson@igalia.com>
>+
>+        [Cairo] Surface pointer passed to asNewNativeImage() might be freed.
>+        https://bugs.webkit.org/show_bug.cgi?id=111179
>+
>+        Reviewed by Darin Adler.
>+
>+        No new tests. This issue is incredibly elusive and I haven't been
>+        able to reproduce it locally. It depends very much on the network speed
>+        and the size of the animated GIF. The code in question seems obviously
>+        wrong.
>+
>+        When producing frames from decoded GIFs, copy the memory of the decoded
>+        frame and properly free it. This is a speculative fix for a very hard
>+        to reproduce issue.
>+
>+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
>+        (WebCore::ImageFrame::asNewNativeImage): Copy the memory when producing frames
>+        from decoded images. It might disappear at any time and then the image will
>+        be corrupt.
>+
> 2016-02-18  Brady Eidson  <beidson@apple.com>
> 
>         Modern IDB: Implement client->server operations in WK2.
>diff --git a/Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp b/Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
>index 3fe704023419d9753b1399d9f6c00b6739451296..a4bf0e95438d0e293a1c86cef20d00930254611a 100644
>--- a/Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
>+++ b/Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
>@@ -32,9 +32,19 @@ namespace WebCore {
> 
> PassNativeImagePtr ImageFrame::asNewNativeImage() const
> {
>-    return adoptRef(cairo_image_surface_create_for_data(
>-        reinterpret_cast<unsigned char*>(const_cast<PixelData*>(m_bytes)),
>+    PixelData* copiedData = new PixelData[width() * height()];
>+    memcpy(copiedData, m_bytes, width() * height() * sizeof(PixelData));
>+
>+    auto nativeImage = adoptRef(cairo_image_surface_create_for_data(
>+        reinterpret_cast<unsigned char*>(const_cast<PixelData*>(copiedData)),
>         CAIRO_FORMAT_ARGB32, width(), height(), width() * sizeof(PixelData)));
>+
>+    static cairo_user_data_key_t decodedImageKey;
>+    cairo_surface_set_user_data(nativeImage.get(), &decodedImageKey, copiedData, [](void* data) {
>+        delete [] static_cast<PixelData*>(data);
>+    });
>+
>+    return nativeImage;
> }
> 
> } // namespace WebCore

Actions: View | Formatted Diff | Diff

Attachments on bug 111179: 190964 | 192693 | 229057 | 229059 | 233153 | 233200 | 258593 | 273214 | 273528