Attachment 58066 Details for Bug 25645 – Revised (v3) patch to fix SVG number parsing of large numbers

[patch] Revised (v3) patch to fix SVG number parsing of large numbers

bug25645cl (text/plain), 5.01 KB, created by W. James MacLean on 2010-06-07 12:01:42 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: W. James MacLean

Created: 2010-06-07 12:01:42 PDT

Size: 5.01 KB

patch

obsolete

>diff --git a/LayoutTests/svg/custom/massive-coordinates-expected.txt b/LayoutTests/svg/custom/massive-coordinates-expected.txt
>new file mode 100644
>index 0000000..e57aeed
>--- /dev/null
>+++ b/LayoutTests/svg/custom/massive-coordinates-expected.txt
>@@ -0,0 +1,6 @@
>+layer at (0,0) size 800x600
>+  RenderView at (0,0) size 800x600
>+layer at (0,0) size 800x600
>+  RenderSVGRoot {svg} at (0,0) size 800x600
>+    RenderPath {path} at (0,0) size 0x0 [stroke={[type=SOLID] [color=#0000FF]}] [data="M-1000.00,12345679395506094080.00 L200.00,200.00"]
>+    RenderPath {path} at (0,0) size 0x0 [stroke={[type=SOLID] [color=#00FF00]}] [data="M600.00,400.00 L1000.00,-98765435164048752640.00"]
>diff --git a/LayoutTests/svg/custom/massive-coordinates.svg b/LayoutTests/svg/custom/massive-coordinates.svg
>new file mode 100644
>index 0000000..389d8c3
>--- /dev/null
>+++ b/LayoutTests/svg/custom/massive-coordinates.svg
>@@ -0,0 +1,10 @@
>+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
>+
>+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
>+
>+<svg xmlns="http://www.w3.org/2000/svg" height="600" id="svgroot" version="1.1" width="800" x="0" y="0">
>+
>+    <path d="M -1000,12345678901234567890 L 200,200" style="fill:none;stroke:#0000ff;stroke-width:1px;stroke-opacity:1" />
>+    <path d="M 600,400 L 1000,-9.8765432109876543210e+19" style="fill:none;stroke:#00ff00;stroke-width:1px;stroke-opacity:1" />
>+ 
>+</svg>
>diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
>index 4c8989d..2bc20fc 100644
>--- a/WebCore/ChangeLog
>+++ b/WebCore/ChangeLog
>@@ -1,3 +1,24 @@
>+2010-06-07  W. James MacLean  <wjmaclean@google.com>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Revised to improve variable names in enclosingIntRect(), _parseNumber(), and fix style issues.
>+
>+        - Revised FloatRect to remove bad float-to-int conversions in enclosingIntRect()
>+        - Revised _parseNumber to do right-to-left float-based parsing of input value
>+
>+        SVG - numeric overflow for very large elements
>+        https://bugs.webkit.org/show_bug.cgi?id=25645
>+
>+        * svg/custom/massive-coordinates-expected.txt: Added.
>+        * svg/custom/massive-coordinates.svg: Added.
>+
>+        * platform/graphics/FloatRect.cpp:
>+        (WebCore::safeFloatToInt):
>+        (WebCore::enclosingIntRect):
>+        * svg/SVGParserUtilities.cpp:
>+        (WebCore::_parseNumber):
>+
> 2010-06-04  Adam Barth  <abarth@webkit.org>
> 
>         Reviewed by Eric Seidel.
>diff --git a/WebCore/platform/graphics/FloatRect.cpp b/WebCore/platform/graphics/FloatRect.cpp
>index 7a54f21..957148d 100644
>--- a/WebCore/platform/graphics/FloatRect.cpp
>+++ b/WebCore/platform/graphics/FloatRect.cpp
>@@ -110,13 +110,23 @@ void FloatRect::scale(float sx, float sy)
>     m_size.setHeight(height() * sy);
> }
> 
>+static inline int safeFloatToInt(float x)
>+{
>+    if (x >= 2147483648.0f)
>+        return 2147483647;
>+    if (x < -2147483648.0f)
>+        return -2147483647; // not allowed -2147483647 in ISO C90
>+    return static_cast<int>(x);
>+}
>+
> IntRect enclosingIntRect(const FloatRect& rect)
> {
>-    int l = static_cast<int>(floorf(rect.x()));
>-    int t = static_cast<int>(floorf(rect.y()));
>-    int r = static_cast<int>(ceilf(rect.right()));
>-    int b = static_cast<int>(ceilf(rect.bottom()));
>-    return IntRect(l, t, r - l, b - t);
>+    float fLeft = floorf(rect.x());
>+    float fTop = floorf(rect.y());
>+    float fWidth = ceilf(rect.right()) - fLeft;
>+    float fHeight = ceilf(rect.bottom()) - fTop;
>+    return IntRect(safeFloatToInt(fLeft), safeFloatToInt(fTop), 
>+                   safeFloatToInt(fWidth), safeFloatToInt(fHeight));
> }
> 
> FloatRect mapRect(const FloatRect& r, const FloatRect& srcRect, const FloatRect& destRect)
>diff --git a/WebCore/svg/SVGParserUtilities.cpp b/WebCore/svg/SVGParserUtilities.cpp
>index c722232..24981bd 100644
>--- a/WebCore/svg/SVGParserUtilities.cpp
>+++ b/WebCore/svg/SVGParserUtilities.cpp
>@@ -55,8 +55,8 @@ namespace WebCore {
>  */    
> template <typename FloatType> static bool _parseNumber(const UChar*& ptr, const UChar* end, FloatType& number, bool skip)
> {
>-    int integer, exponent;
>-    FloatType decimal, frac;
>+    int exponent;
>+    FloatType integer, decimal, frac;
>     int sign, expsign;
>     const UChar* start = ptr;
> 
>@@ -79,9 +79,19 @@ template <typename FloatType> static bool _parseNumber(const UChar*& ptr, const
>         // The first character of a number must be one of [0-9+-.]
>         return false;
> 
>-    // read the integer part
>+    // read the integer part, build right-to-left
>+    const UChar *ptrStartIntPart = ptr;
>     while (ptr < end && *ptr >= '0' && *ptr <= '9')
>-        integer = (integer * 10) + *(ptr++) - '0';
>+      ++ptr; // Advance to first non-digit.
>+
>+    if (ptr != ptrStartIntPart) {
>+      const UChar *ptrScanIntPart = ptr - 1;
>+      FloatType multiplier = 1;
>+      while (ptrScanIntPart >= ptrStartIntPart) {
>+        integer = integer + multiplier * static_cast<FloatType>(*(ptrScanIntPart--) - '0');
>+        multiplier *= 10;
>+      }
>+    }
> 
>     if (ptr < end && *ptr == '.') { // read the decimals
>         ptr++;

Flags:

zimmermann: review-

Actions: View | Formatted Diff | Diff

Attachments on bug 25645: 30132 | 51467 | 53973 | 53974 | 55237 | 57913 | 58066 | 58072 | 58167 | 58370 | 58470 | 58472 | 58476 | 62859 | 62866 | 62869 | 62940 | 63063 | 63096 | 63464 | 63584 | 63587