WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
[patch]
Revised (vF) patch to fix SVG number parsing of large numbers
bug25645cl (text/plain), 14.50 KB, created by
W. James MacLean
on 2010-07-30 13:10:12 PDT
(
hide
)
Description:
Revised (vF) patch to fix SVG number parsing of large numbers
Filename:
MIME Type:
Creator:
W. James MacLean
Created:
2010-07-30 13:10:12 PDT
Size:
14.50 KB
patch
obsolete
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog >index 9d0896a..9f89e4a 100644 >--- a/LayoutTests/ChangeLog >+++ b/LayoutTests/ChangeLog >@@ -1,3 +1,27 @@ >+2010-07-28 W. James MacLean <wjmaclean@google.com> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ SVG - numeric overflow for very large elements >+ https://bugs.webkit.org/show_bug.cgi?id=25645 >+ >+ Two of the expected test outputs were incorrect now that parsing of large values >+ is handled correctly. >+ - Revised FloatRect to remove bad float-to-int conversions in enclosingIntRect() >+ - Revised _parseNumber to do right-to-left float-based parsing of input value >+ >+ * platform/gtk/svg/custom/pattern-excessive-malloc-expected.txt: Removed. >+ * platform/mac/svg/custom/mask-excessive-malloc-expected.txt: >+ * platform/mac/svg/custom/massive-coordinates-expected.txt: Added. >+ * platform/mac/svg/custom/pattern-excessive-malloc-expected.txt: >+ * platform/qt/svg/custom/pattern-excessive-malloc-expected.checksum: Removed. >+ * platform/qt/svg/custom/pattern-excessive-malloc-expected.png: Removed. >+ * platform/qt/svg/custom/pattern-excessive-malloc-expected.txt: Removed. >+ * svg/custom/mask-excessive-malloc-expected.txt: Added. >+ * svg/custom/massive-coordinates-expected.txt: Added. >+ * svg/custom/massive-coordinates.svg: Added. >+ * svg/custom/pattern-excessive-malloc-expected.txt: Added. >+ > 2010-07-28 Victor Wang <victorw@chromium.org> > > Unreviewed. Update chromium test expectations for tesst that >diff --git a/LayoutTests/platform/gtk/svg/custom/pattern-excessive-malloc-expected.txt b/LayoutTests/platform/gtk/svg/custom/pattern-excessive-malloc-expected.txt >deleted file mode 100644 >index ac7575d..0000000 >--- a/LayoutTests/platform/gtk/svg/custom/pattern-excessive-malloc-expected.txt >+++ /dev/null >@@ -1,8 +0,0 @@ >-layer at (0,0) size 800x600 >- RenderView at (0,0) size 800x600 >-layer at (0,0) size 800x600 >- RenderSVGRoot {svg} at (10,300) size 100x100 >- RenderSVGHiddenContainer {defs} at (0,0) size 0x0 >- RenderSVGResourcePattern {pattern} [id="pattern"] [patternUnits=userSpaceOnUse] [patternContentUnits=userSpaceOnUse] >- RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FF0000]}] [data="M0.00,0.00 L7792640.00,0.00 L7792640.00,7792640.00 L0.00,7792640.00 Z"] >- RenderPath {rect} at (10,300) size 100x100 [fill={[type=PATTERN] [id="pattern"]}] [data="M10.00,300.00 L110.00,300.00 L110.00,400.00 L10.00,400.00 Z"] >diff --git a/LayoutTests/platform/mac/svg/custom/mask-excessive-malloc-expected.txt b/LayoutTests/platform/mac/svg/custom/mask-excessive-malloc-expected.txt >index 962affa..c893d03 100644 >--- a/LayoutTests/platform/mac/svg/custom/mask-excessive-malloc-expected.txt >+++ b/LayoutTests/platform/mac/svg/custom/mask-excessive-malloc-expected.txt >@@ -3,6 +3,6 @@ layer at (0,0) size 800x600 > layer at (0,0) size 800x600 > RenderSVGRoot {svg} at (200,200) size 100x200 > RenderSVGResourceMasker {mask} [id="mask"] [maskUnits=objectBoundingBox] [maskContentUnits=userSpaceOnUse] >- RenderPath {rect} at (0,0) size 0x0 [fill={[type=SOLID] [color=#FFFFFF]}] [data="M0.00,0.00 L2147483648.00,0.00 L2147483648.00,2147483648.00 L0.00,2147483648.00 Z"] >+ RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FFFFFF]}] [data="M0.00,0.00 L2147483648.00,0.00 L2147483648.00,2147483648.00 L0.00,2147483648.00 Z"] > RenderPath {path} at (200,200) size 100x200 [fill={[type=SOLID] [color=#0000FF]}] [data="M200.00,200.00 L300.00,200.00 L300.00,400.00 L200.00,400.00 Z"] > [masker="mask"] RenderSVGResourceMasker {mask} at (190,180) size 2147483520x2147483520 >diff --git a/LayoutTests/platform/mac/svg/custom/massive-coordinates-expected.txt b/LayoutTests/platform/mac/svg/custom/massive-coordinates-expected.txt >new file mode 100644 >index 0000000..3b0b197 >--- /dev/null >+++ b/LayoutTests/platform/mac/svg/custom/massive-coordinates-expected.txt >@@ -0,0 +1,6 @@ >+layer at (0,0) size 800x600 >+ RenderView at (0,0) size 800x600 >+layer at (0,0) size 800x600 >+ RenderSVGRoot {svg} at (0,0) size 0x0 >+ RenderPath {path} at (0,0) size 0x0 [stroke={[type=SOLID] [color=#0000FF]}] [data="M-1000.00,12345679395506094080.00 L200.00,200.00"] >+ RenderPath {path} at (0,0) size 0x0 [stroke={[type=SOLID] [color=#00FF00]}] [data="M600.00,400.00 L1000.00,-98765426367955730432.00"] >diff --git a/LayoutTests/platform/mac/svg/custom/pattern-excessive-malloc-expected.txt b/LayoutTests/platform/mac/svg/custom/pattern-excessive-malloc-expected.txt >index a33dcfb..1d4a8af 100644 >--- a/LayoutTests/platform/mac/svg/custom/pattern-excessive-malloc-expected.txt >+++ b/LayoutTests/platform/mac/svg/custom/pattern-excessive-malloc-expected.txt >@@ -4,5 +4,5 @@ layer at (0,0) size 800x600 > RenderSVGRoot {svg} at (10,300) size 100x100 > RenderSVGHiddenContainer {defs} at (0,0) size 0x0 > RenderSVGResourcePattern {pattern} [id="pattern"] [patternUnits=userSpaceOnUse] [patternContentUnits=userSpaceOnUse] >- RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FF0000]}] [data="M0.00,0.00 L1215752192.00,0.00 L1215752192.00,1215752192.00 L0.00,1215752192.00 Z"] >+ RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FF0000]}] [data="M0.00,0.00 L99999997952.00,0.00 L99999997952.00,99999997952.00 L0.00,99999997952.00 Z"] > RenderPath {rect} at (10,300) size 100x100 [fill={[type=PATTERN] [id="pattern"]}] [data="M10.00,300.00 L110.00,300.00 L110.00,400.00 L10.00,400.00 Z"] >diff --git a/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.checksum b/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.checksum >deleted file mode 100644 >index 88da121..0000000 >--- a/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.checksum >+++ /dev/null >@@ -1 +0,0 @@ >-7290a75aa2c5543d87f68f7200683c20 >\ No newline at end of file >diff --git a/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.png b/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.png >deleted file mode 100644 >index 157abe54755c04503808df0ad643a4f37109c8bf..0000000000000000000000000000000000000000 >GIT binary patch >literal 0 >HcmV?d00001 > >literal 3279 >zcmeAS@N?(olHy`uVBq!ia0y~yU{+vYV2a>i1B%QlYbpRzoCO|{#S9F5M?jcysy3fA >z0|QT^r;B4q#hkY{Hwrd5@UR%pTljyPFL%uWA%&xSdUrq0nrR8t$@Kg>GXq1ze*vJG >z4sH!V5lKcS28I+C4hDt^f}?_?0Wz8xMl-@_$uN>j#hI@^K8?~pmvH;cb#4ZRgxUO~ >zb;D?7$-n?g7H7JRfvpGo4~&cq3`R^W3=AhY1Q-|;lpTPgJq)9QqX9CS7)EMFC}uXV >X=UF$^_v3zGBbvd})z4*}Q$iB}CnKE3 > >diff --git a/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.txt b/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.txt >deleted file mode 100644 >index 46e8575..0000000 >--- a/LayoutTests/platform/qt/svg/custom/pattern-excessive-malloc-expected.txt >+++ /dev/null >@@ -1,8 +0,0 @@ >-layer at (0,0) size 800x600 >- RenderView at (0,0) size 800x600 >-layer at (0,0) size 800x600 >- RenderSVGRoot {svg} at (10,300) size 100x100 >- RenderSVGHiddenContainer {defs} at (0,0) size 0x0 >- RenderSVGResourcePattern {pattern} [id="pattern"] [patternUnits=userSpaceOnUse] [patternContentUnits=userSpaceOnUse] >- RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FF0000]}] [data="M0.00,0.00 L1215752192.00,0.00 L1215752192.00,1215752192.00 L0.00,1215752192.00 L0.00,0.00"] >- RenderPath {rect} at (10,300) size 100x100 [fill={[type=PATTERN] [id="pattern"]}] [data="M10.00,300.00 L110.00,300.00 L110.00,400.00 L10.00,400.00 L10.00,300.00"] >diff --git a/LayoutTests/svg/custom/mask-excessive-malloc-expected.txt b/LayoutTests/svg/custom/mask-excessive-malloc-expected.txt >new file mode 100644 >index 0000000..c893d03 >--- /dev/null >+++ b/LayoutTests/svg/custom/mask-excessive-malloc-expected.txt >@@ -0,0 +1,8 @@ >+layer at (0,0) size 800x600 >+ RenderView at (0,0) size 800x600 >+layer at (0,0) size 800x600 >+ RenderSVGRoot {svg} at (200,200) size 100x200 >+ RenderSVGResourceMasker {mask} [id="mask"] [maskUnits=objectBoundingBox] [maskContentUnits=userSpaceOnUse] >+ RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FFFFFF]}] [data="M0.00,0.00 L2147483648.00,0.00 L2147483648.00,2147483648.00 L0.00,2147483648.00 Z"] >+ RenderPath {path} at (200,200) size 100x200 [fill={[type=SOLID] [color=#0000FF]}] [data="M200.00,200.00 L300.00,200.00 L300.00,400.00 L200.00,400.00 Z"] >+ [masker="mask"] RenderSVGResourceMasker {mask} at (190,180) size 2147483520x2147483520 >diff --git a/LayoutTests/svg/custom/massive-coordinates-expected.txt b/LayoutTests/svg/custom/massive-coordinates-expected.txt >new file mode 100644 >index 0000000..9ed02da >--- /dev/null >+++ b/LayoutTests/svg/custom/massive-coordinates-expected.txt >@@ -0,0 +1,6 @@ >+layer at (0,0) size 800x600 >+ RenderView at (0,0) size 800x600 >+layer at (0,0) size 800x600 >+ RenderSVGRoot {svg} at (0,0) size 0x0 >+ RenderPath {path} at (0,0) size 0x0 [stroke={[type=SOLID] [color=#0000FF]}] [data="M-1000.00,12345679395506094080.00 L200.00,200.00"] >+ RenderPath {path} at (0,0) size 0x0 [stroke={[type=SOLID] [color=#00FF00]}] [data="M600.00,400.00 L1000.00,-98765435164048752640.00"] >diff --git a/LayoutTests/svg/custom/massive-coordinates.svg b/LayoutTests/svg/custom/massive-coordinates.svg >new file mode 100644 >index 0000000..da1cde3 >--- /dev/null >+++ b/LayoutTests/svg/custom/massive-coordinates.svg >@@ -0,0 +1,12 @@ >+<?xml version="1.0" encoding="UTF-8" standalone="no"?> >+ >+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> >+ >+<svg xmlns="http://www.w3.org/2000/svg" height="600" id="svgroot" version="1.1" width="800" x="0" y="0"> >+ >+ <path d="M -1000,12345678901234567890 L 200,200" style="fill:none;stroke:#0000ff;stroke-width:1px;stroke-opacity:1" /> >+ <path d="M 600,400 L 1000,-9.8765432109876543210e+19" style="fill:none;stroke:#00ff00;stroke-width:1px;stroke-opacity:1" /> >+ >+</svg> >+ >+ >diff --git a/LayoutTests/svg/custom/pattern-excessive-malloc-expected.txt b/LayoutTests/svg/custom/pattern-excessive-malloc-expected.txt >new file mode 100644 >index 0000000..1d4a8af >--- /dev/null >+++ b/LayoutTests/svg/custom/pattern-excessive-malloc-expected.txt >@@ -0,0 +1,8 @@ >+layer at (0,0) size 800x600 >+ RenderView at (0,0) size 800x600 >+layer at (0,0) size 800x600 >+ RenderSVGRoot {svg} at (10,300) size 100x100 >+ RenderSVGHiddenContainer {defs} at (0,0) size 0x0 >+ RenderSVGResourcePattern {pattern} [id="pattern"] [patternUnits=userSpaceOnUse] [patternContentUnits=userSpaceOnUse] >+ RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FF0000]}] [data="M0.00,0.00 L99999997952.00,0.00 L99999997952.00,99999997952.00 L0.00,99999997952.00 Z"] >+ RenderPath {rect} at (10,300) size 100x100 [fill={[type=PATTERN] [id="pattern"]}] [data="M10.00,300.00 L110.00,300.00 L110.00,400.00 L10.00,400.00 Z"] >diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog >index 32e55c0..ab59eb6 100644 >--- a/WebCore/ChangeLog >+++ b/WebCore/ChangeLog >@@ -1,3 +1,23 @@ >+2010-07-28 W. James MacLean <wjmaclean@google.com> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ SVG - numeric overflow for very large elements >+ https://bugs.webkit.org/show_bug.cgi?id=25645 >+ >+ Two of the expected test outputs were incorrect now that parsing of large values >+ is handled correctly. >+ - Revised FloatRect to remove bad float-to-int conversions in enclosingIntRect() >+ - Revised _parseNumber to do right-to-left float-based parsing of input value >+ >+ Test: svg/custom/massive-coordinates.svg >+ >+ * platform/graphics/FloatRect.cpp: >+ (WebCore::safeFloatToInt): >+ (WebCore::enclosingIntRect): >+ * svg/SVGParserUtilities.cpp: >+ (WebCore::_parseNumber): >+ > 2010-07-28 Tony Gentilcore <tonyg@chromium.org> > > Reviewed by Pavel Feldman. >diff --git a/WebCore/platform/graphics/FloatRect.cpp b/WebCore/platform/graphics/FloatRect.cpp >index 7a54f21..6dfa808 100644 >--- a/WebCore/platform/graphics/FloatRect.cpp >+++ b/WebCore/platform/graphics/FloatRect.cpp >@@ -30,6 +30,7 @@ > #include "FloatConversion.h" > #include "IntRect.h" > #include <algorithm> >+#include <limits> > #include <math.h> > > using std::max; >@@ -110,13 +111,26 @@ void FloatRect::scale(float sx, float sy) > m_size.setHeight(height() * sy); > } > >+static inline int safeFloatToInt(float x) >+{ >+ static const int s_intMax = std::numeric_limits<int>::max(); >+ static const int s_intMin = std::numeric_limits<int>::min(); >+ >+ if (x >= static_cast<float>(s_intMax)) >+ return s_intMax; >+ if (x < static_cast<float>(s_intMin)) >+ return s_intMin; >+ return static_cast<int>(x); >+} >+ > IntRect enclosingIntRect(const FloatRect& rect) > { >- int l = static_cast<int>(floorf(rect.x())); >- int t = static_cast<int>(floorf(rect.y())); >- int r = static_cast<int>(ceilf(rect.right())); >- int b = static_cast<int>(ceilf(rect.bottom())); >- return IntRect(l, t, r - l, b - t); >+ float left = floorf(rect.x()); >+ float top = floorf(rect.y()); >+ float width = ceilf(rect.right()) - left; >+ float height = ceilf(rect.bottom()) - top; >+ return IntRect(safeFloatToInt(left), safeFloatToInt(top), >+ safeFloatToInt(width), safeFloatToInt(height)); > } > > FloatRect mapRect(const FloatRect& r, const FloatRect& srcRect, const FloatRect& destRect) >diff --git a/WebCore/svg/SVGParserUtilities.cpp b/WebCore/svg/SVGParserUtilities.cpp >index 14e3d58..b5e695b 100644 >--- a/WebCore/svg/SVGParserUtilities.cpp >+++ b/WebCore/svg/SVGParserUtilities.cpp >@@ -40,8 +40,8 @@ namespace WebCore { > */ > template <typename FloatType> static bool _parseNumber(const UChar*& ptr, const UChar* end, FloatType& number, bool skip) > { >- int integer, exponent; >- FloatType decimal, frac; >+ int exponent; >+ FloatType integer, decimal, frac; > int sign, expsign; > const UChar* start = ptr; > >@@ -64,9 +64,19 @@ template <typename FloatType> static bool _parseNumber(const UChar*& ptr, const > // The first character of a number must be one of [0-9+-.] > return false; > >- // read the integer part >+ // read the integer part, build right-to-left >+ const UChar* ptrStartIntPart = ptr; > while (ptr < end && *ptr >= '0' && *ptr <= '9') >- integer = (integer * 10) + *(ptr++) - '0'; >+ ++ptr; // Advance to first non-digit. >+ >+ if (ptr != ptrStartIntPart) { >+ const UChar* ptrScanIntPart = ptr - 1; >+ FloatType multiplier = 1; >+ while (ptrScanIntPart >= ptrStartIntPart) { >+ integer += multiplier * static_cast<FloatType>(*(ptrScanIntPart--) - '0'); >+ multiplier *= 10; >+ } >+ } > > if (ptr < end && *ptr == '.') { // read the decimals > ptr++;
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=63096">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 25645
:
30132
|
51467
|
53973
|
53974
|
55237
|
57913
|
58066
|
58072
|
58167
|
58370
|
58470
|
58472
|
58476
|
62859
|
62866
|
62869
|
62940
|
63063
| 63096 |
63464
|
63584
|
63587