Attachment 377837 Details for Bug 196340 – Patch

[patch] Patch

bug-196340-20190902132324.patch (text/plain), 2.27 KB, created by Fujii Hironori on 2019-09-01 21:23:25 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Fujii Hironori

Created: 2019-09-01 21:23:25 PDT

Size: 2.27 KB

patch

obsolete

>Subversion Revision: 249372
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 2eb407163a8225c3725fc9cc8ec2b8c4bfbcd593..9863ff24428ee8691c7fd36489a27a69a908d3f8 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,18 @@
>+2019-09-01  Fujii Hironori  <Hironori.Fujii@sony.com>
>+
>+        [Cairo] out-of-bounds read in ShareableBitmap::paint if a fractional device scale factor is used
>+        https://bugs.webkit.org/show_bug.cgi?id=196340
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        In ShareableBitmap::paint, srcRectScaled can be out-of-bounds of
>+        the surface if a fractional device scale factor is used.
>+
>+        * Shared/cairo/ShareableBitmapCairo.cpp:
>+        (WebKit::ShareableBitmap::paint): Use cairoSurfaceSetDeviceScale
>+        to set a device scale factor to the surface instead of multiplying
>+        srcRect with a device scale factor.
>+
> 2019-09-01  Fujii Hironori  <Hironori.Fujii@sony.com>
> 
>         Unreviewed, rolling out r249366.
>diff --git a/Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp b/Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp
>index b2cd4846677ce97dfac2858490c1ea434f962933..842cbfae8c55f9ab2d9dd19813d1170a3a1a1652 100644
>--- a/Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp
>+++ b/Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp
>@@ -71,13 +71,12 @@ void ShareableBitmap::paint(GraphicsContext& context, const IntPoint& dstPoint,
> void ShareableBitmap::paint(GraphicsContext& context, float scaleFactor, const IntPoint& dstPoint, const IntRect& srcRect)
> {
>     RefPtr<cairo_surface_t> surface = createSurfaceFromData(data(), m_size);
>+    cairoSurfaceSetDeviceScale(surface.get(), scaleFactor, scaleFactor);
>     FloatRect destRect(dstPoint, srcRect.size());
>-    FloatRect srcRectScaled(srcRect);
>-    srcRectScaled.scale(scaleFactor);
> 
>     ASSERT(context.hasPlatformContext());
>     auto& state = context.state();
>-    Cairo::drawSurface(*context.platformContext(), surface.get(), destRect, srcRectScaled, state.imageInterpolationQuality, state.alpha, Cairo::ShadowState(state));
>+    Cairo::drawSurface(*context.platformContext(), surface.get(), destRect, srcRect, state.imageInterpolationQuality, state.alpha, Cairo::ShadowState(state));
> }
> 
> RefPtr<cairo_surface_t> ShareableBitmap::createCairoSurface()

Actions: View | Formatted Diff | Diff

Attachments on bug 196340: 366154 | 377837