Skip to content

Commit

Permalink
#453: bounds-check CoreGraphics paths because Facebook sucks
Browse files Browse the repository at this point in the history
  • Loading branch information
@classilla
classilla committed Jan 25, 2018
1 parent c7563bb commit 4d24850
Showing 1 changed file with 45 additions and 101 deletions.
146 changes: 45 additions & 101 deletions gfx/2d/DrawTargetCG.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -142,99 +142,6 @@ static void inline this_CGContextSetBlendMode(CGContextRef cg, CompositionOp op)
(CGBlendMode)(pcm - kPrivateCGBlendModesStartHere));
}

// marked for DEATH
PrivateCGCompositeMode ToOldBlendMode(CompositionOp op)
{
PrivateCGCompositeMode mode = kPrivateCGCompositeSourceOver;
switch (op) {
case CompositionOp::OP_OVER:
mode = kPrivateCGBlendModeNormal; // ??? kPrivateCGCompositeSourceOver;
break;
case CompositionOp::OP_ADD:
mode = kPrivateCGCompositePlusLighter;
break;
case CompositionOp::OP_ATOP:
mode = kPrivateCGCompositeSourceAtop;
break;
case CompositionOp::OP_OUT:
mode = kPrivateCGCompositeSourceOut;
break;
case CompositionOp::OP_IN:
mode = kPrivateCGCompositeSourceIn;
break;
case CompositionOp::OP_SOURCE:
mode = kPrivateCGCompositeCopy;
break;
case CompositionOp::OP_DEST_IN:
mode = kPrivateCGCompositeDestinationIn;
break;
case CompositionOp::OP_DEST_OUT:
mode = kPrivateCGCompositeDestinationOut;
break;
case CompositionOp::OP_DEST_OVER:
mode = kPrivateCGCompositeDestinationOver;
break;
case CompositionOp::OP_DEST_ATOP:
mode = kPrivateCGCompositeSourceAtop;
break;
case CompositionOp::OP_XOR:
mode = kPrivateCGCompositeXOR;
break;
case CompositionOp::OP_MULTIPLY:
mode = kPrivateCGBlendModeMultiply;
break;
case CompositionOp::OP_SCREEN:
mode = kPrivateCGBlendModeScreen;
break;
case CompositionOp::OP_OVERLAY:
mode = kPrivateCGBlendModeOverlay;
break;
case CompositionOp::OP_DARKEN:
mode = kPrivateCGBlendModeDarken;
break;
case CompositionOp::OP_LIGHTEN:
mode = kPrivateCGBlendModeLighten;
break;
case CompositionOp::OP_COLOR_DODGE:
mode = kPrivateCGBlendModeColorDodge;
break;
case CompositionOp::OP_COLOR_BURN:
mode = kPrivateCGBlendModeColorBurn;
break;
case CompositionOp::OP_HARD_LIGHT:
mode = kPrivateCGBlendModeHardLight;
break;
case CompositionOp::OP_SOFT_LIGHT:
mode = kPrivateCGBlendModeSoftLight;
break;
case CompositionOp::OP_DIFFERENCE:
mode = kPrivateCGBlendModeDifference;
break;
case CompositionOp::OP_EXCLUSION:
mode = kPrivateCGBlendModeExclusion;
break;
case CompositionOp::OP_HUE:
mode = kPrivateCGBlendModeHue;
break;
case CompositionOp::OP_SATURATION:
mode = kPrivateCGBlendModeSaturation;
break;
case CompositionOp::OP_COLOR:
mode = kPrivateCGBlendModeColor;
break;
case CompositionOp::OP_LUMINOSITY:
mode = kPrivateCGBlendModeLuminosity;
break;
/*
case OP_CLEAR:
mode = kPrivateCGCompositeClear;
break;*/
default:
mode = kPrivateCGBlendModeNormal; // ??? kPrivateCGCompositeSourceOver;
}
return mode;
}

#else

static void inline this_CGContextSetBlendMode(CGContextRef cg, CGBlendMode m) {
Expand Down Expand Up @@ -348,6 +255,25 @@ InterpolationQualityFromFilter(Filter aFilter)
}
}

// TenFourFox issue 453
// There is no bounds-checking on CoreGraphics paths.
// Also, Facebook can suck me.
static inline bool this_CGContextAddPath(CGContextRef aContext, CGPathRef aPath)
{
// Empty paths are always acceptable (and shouldn't be added anyway).
if (CGPathIsEmpty(aPath)) return true;

// Non-empty paths need to be bounds-checked.
CGRect r = CGPathGetBoundingBox(aPath);
if (MOZ_UNLIKELY(CGRectIsNull(r))) return true; // should have been caught above?
if (MOZ_UNLIKELY(r.origin.x >= INT_MAX || r.origin.x <= INT_MIN)) return false;
if (MOZ_UNLIKELY(r.origin.y >= INT_MAX || r.origin.y <= INT_MIN)) return false;
if (MOZ_UNLIKELY(r.size.height >= INT_MAX)) return false;
if (MOZ_UNLIKELY(r.size.width >= INT_MAX)) return false;

CGContextAddPath(aContext, aPath);
return true;
}

DrawTargetCG::DrawTargetCG()
: mColorSpace(nullptr)
Expand Down Expand Up @@ -1643,7 +1569,12 @@ DrawTargetCG::Stroke(const Path *aPath, const Pattern &aPattern, const StrokeOpt

//assert(aPath->GetBackendType() == BackendType::COREGRAPHICS);
const PathCG *cgPath = static_cast<const PathCG*>(aPath);
CGContextAddPath(cg, cgPath->GetPath());
if (MOZ_UNLIKELY(!this_CGContextAddPath(cg, cgPath->GetPath()))) {
fprintf(stderr, "Warning: TenFourFox DrawTargetCG::Stroke received an illegal path coordinate.\n");
fixer.Fix(this);
CGContextRestoreGState(mCg);
return;
}

SetStrokeOptions(cg, aStrokeOptions);

Expand Down Expand Up @@ -1700,7 +1631,12 @@ DrawTargetCG::Fill(const Path *aPath, const Pattern &aPattern, const DrawOptions
CGContextClipToRect(mCg, CGRectZero);
extents = CGRectZero;
} else {
CGContextAddPath(cg, cgPath->GetPath());
if (MOZ_UNLIKELY(!this_CGContextAddPath(cg, cgPath->GetPath()))) {
fprintf(stderr, "Warning: TenFourFox DrawTargetCG::Fill received an illegal path coordinate.\n");
fixer.Fix(this);
CGContextRestoreGState(mCg);
return;
}
extents = CGContextGetPathBoundingBox(cg);
if (cgPath->GetFillRule() == FillRule::FILL_EVEN_ODD)
CGContextEOClip(mCg);
Expand All @@ -1710,7 +1646,12 @@ DrawTargetCG::Fill(const Path *aPath, const Pattern &aPattern, const DrawOptions

DrawGradient(mColorSpace, cg, aPattern, extents);
} else {
CGContextAddPath(cg, cgPath->GetPath());
if (MOZ_UNLIKELY(!this_CGContextAddPath(cg, cgPath->GetPath()))) {
fprintf(stderr, "Warning: TenFourFox DrawTargetCG::Fill received an illegal path coordinate.\n");
fixer.Fix(this);
CGContextRestoreGState(mCg);
return;
}

SetFillFromPattern(cg, mColorSpace, aPattern);

Expand Down Expand Up @@ -2050,10 +1991,10 @@ DrawTargetCG::Init(BackendType aType,
{
// XXX: we should come up with some consistent semantics for dealing
// with zero area drawtargets
if (aSize.width <= 0 ||
if (MOZ_UNLIKELY(aSize.width <= 0 ||
aSize.height <= 0 ||
size_t(aSize.width) > GetMaxSurfaceSize() ||
size_t(aSize.height) > GetMaxSurfaceSize())
size_t(aSize.height) > GetMaxSurfaceSize()))
{
gfxWarning() << "Failed to Init() DrawTargetCG because of bad size.";
mColorSpace = nullptr;
Expand Down Expand Up @@ -2128,7 +2069,7 @@ DrawTargetCG::Init(BackendType aType,
}

//assert(mCg);
if (!mCg) {
if (MOZ_UNLIKELY(!mCg)) {
gfxCriticalError() << "Failed to create CG context" << mSize << ", " << aStride;
return false;
}
Expand Down Expand Up @@ -2242,7 +2183,7 @@ DrawTargetCG::Init(CGContextRef cgContext, const IntSize &aSize)
CGContextRetain(mCg);

//assert(mCg);
if (!mCg) {
if (MOZ_UNLIKELY(!mCg)) {
gfxCriticalError() << "Invalid CG context at Init " << aSize;
return false;
}
Expand Down Expand Up @@ -2384,7 +2325,10 @@ DrawTargetCG::PushClip(const Path *aPath)
* while we add the path. XXX: this could be improved if we keep
* the CTM as resident state on the DrawTarget. */
CGContextSaveGState(mCg);
CGContextAddPath(mCg, cgPath->GetPath());
if (MOZ_UNLIKELY(!this_CGContextAddPath(mCg, cgPath->GetPath()))) {
fprintf(stderr, "Warning: TenFourFox DrawTargetCG::PushClip received an illegal coordinate.\n");
return;
}
CGContextRestoreGState(mCg);

if (cgPath->GetFillRule() == FillRule::FILL_EVEN_ODD)
Expand Down

0 comments on commit 4d24850

Please sign in to comment.