Attachment 813563 Details for Bug 922600

[patch] Avoid integer overflow using CheckedInt and rearranging the number of bytes computation.

922600.p1 (text/plain), 1.90 KB, created by Milan Sreckovic [:milan] (needinfo for best results)

(hide)

Description:

Filename:

MIME Type:

Creator: Milan Sreckovic [:milan] (needinfo for best results)

Size: 1.90 KB

patch

obsolete

># HG changeset patch
># User Milan Sreckovic <milan@mozilla.com>
># Date 1380819214 14400
># Node ID 8107278c48189c8fedbb9c0296dd786a17b561d3
># Parent  51b36c5fd45fc39914478dd5c0175bbadf0a5a7f
>Bug 922600: Avoid integer overflow. r=bjacob
>
>diff --git a/gfx/thebes/gfxXlibSurface.cpp b/gfx/thebes/gfxXlibSurface.cpp
>old mode 100644
>new mode 100755
>--- a/gfx/thebes/gfxXlibSurface.cpp
>+++ b/gfx/thebes/gfxXlibSurface.cpp
>@@ -12,16 +12,17 @@
> #undef max // Xlibint.h defines this and it breaks std::max
> #undef min // Xlibint.h defines this and it breaks std::min
> 
> #include "nsAutoPtr.h"
> #include "nsTArray.h"
> #include "nsAlgorithm.h"
> #include "mozilla/Preferences.h"
> #include <algorithm>
>+#include "mozilla/CheckedInt.h"
> 
> using namespace mozilla;
> 
> // Although the dimension parameters in the xCreatePixmapReq wire protocol are
> // 16-bit unsigned integers, the server's CreatePixmap returns BadAlloc if
> // either dimension cannot be represented by a 16-bit *signed* integer.
> #define XLIB_IMAGE_SIDE_SIZE_LIMIT 0x7fff
> 
>@@ -116,20 +117,25 @@ CreatePixmap(Screen *screen, const gfxIn
> }
> 
> void
> gfxXlibSurface::TakePixmap()
> {
>     NS_ASSERTION(!mPixmapTaken, "I already own the Pixmap!");
>     mPixmapTaken = true;
> 
>+    int bitDepth = cairo_xlib_surface_get_depth(CairoSurface());
>+    NS_ASSERTION((bitDepth % 8) == 0, "Memory used not recorded correctly");
>+
>     // Divide by 8 because surface_get_depth gives us the number of *bits* per
>     // pixel.
>-    RecordMemoryUsed(mSize.width * mSize.height *
>-        cairo_xlib_surface_get_depth(CairoSurface()) / 8);
>+    CheckedInt32 totalBytes = CheckedInt32(mSize.width) * CheckedInt32(mSize.height) * (bitDepth/8);
>+    if (totalBytes.isValid()) {
>+        RecordMemoryUsed(totalBytes.value());
>+    }
> }
> 
> Drawable
> gfxXlibSurface::ReleasePixmap() {
>     NS_ASSERTION(mPixmapTaken, "I don't own the Pixmap!");
>     mPixmapTaken = false;
>     RecordMemoryFreed();
>     return mDrawable;

Flags:

bjacob: review-

Actions: View | Diff | Review

Attachments on bug 922600: 813325 | 813563 | 818052

Bugzilla

Quick Search

Attachment 813563 Details for Bug 922600