guix-devel/gnu/packages/patches/icecat-CVE-2015-7189.patch

144 lines
4.9 KiB
Diff

From 377e1cefec0fcf230caafb97b4414c835d27c7fe Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Fri, 2 Oct 2015 09:18:26 +0200
Subject: [PATCH] Bug 1205900 - Compare context and canvas element sizes before
extracting the data. r=gwright, a=al
--HG--
extra : source : f6c99c8baa9b0b6a34d6791e5d4031a2de8f2087
---
dom/canvas/CanvasRenderingContext2D.cpp | 2 --
dom/canvas/CanvasRenderingContext2D.h | 7 +++----
dom/canvas/WebGLContext.cpp | 2 --
dom/canvas/WebGLContext.h | 3 +--
dom/canvas/nsICanvasRenderingContextInternal.h | 8 +++-----
dom/html/HTMLCanvasElement.cpp | 13 +++++++------
6 files changed, 14 insertions(+), 21 deletions(-)
diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index d9eaf99..a06fbce 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -1418,7 +1418,6 @@ CanvasRenderingContext2D::EnsureTarget(RenderingMode aRenderingMode)
return mode;
}
-#ifdef DEBUG
int32_t
CanvasRenderingContext2D::GetWidth() const
{
@@ -1430,7 +1429,6 @@ CanvasRenderingContext2D::GetHeight() const
{
return mHeight;
}
-#endif
NS_IMETHODIMP
CanvasRenderingContext2D::SetDimensions(int32_t width, int32_t height)
diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h
index af29c78..e853987 100644
--- a/dom/canvas/CanvasRenderingContext2D.h
+++ b/dom/canvas/CanvasRenderingContext2D.h
@@ -481,10 +481,9 @@ public:
nsresult Redraw();
-#ifdef DEBUG
- virtual int32_t GetWidth() const override;
- virtual int32_t GetHeight() const override;
-#endif
+ virtual int32_t GetWidth() const override;
+ virtual int32_t GetHeight() const override;
+
// nsICanvasRenderingContextInternal
/**
* Gets the pres shell from either the canvas element or the doc shell
diff --git a/dom/canvas/WebGLContext.cpp b/dom/canvas/WebGLContext.cpp
index 1c22c27..f2a620a 100644
--- a/dom/canvas/WebGLContext.cpp
+++ b/dom/canvas/WebGLContext.cpp
@@ -463,7 +463,6 @@ WebGLContext::SetContextOptions(JSContext* cx, JS::Handle<JS::Value> options)
return NS_OK;
}
-#ifdef DEBUG
int32_t
WebGLContext::GetWidth() const
{
@@ -475,7 +474,6 @@ WebGLContext::GetHeight() const
{
return mHeight;
}
-#endif
/* So there are a number of points of failure here. We might fail based
* on EGL vs. WGL, or we might fail to alloc a too-large size, or we
diff --git a/dom/canvas/WebGLContext.h b/dom/canvas/WebGLContext.h
index 63c4091..210f341 100644
--- a/dom/canvas/WebGLContext.h
+++ b/dom/canvas/WebGLContext.h
@@ -202,10 +202,9 @@ public:
NS_DECL_NSIDOMWEBGLRENDERINGCONTEXT
// nsICanvasRenderingContextInternal
-#ifdef DEBUG
virtual int32_t GetWidth() const override;
virtual int32_t GetHeight() const override;
-#endif
+
NS_IMETHOD SetDimensions(int32_t width, int32_t height) override;
NS_IMETHOD InitializeWithSurface(nsIDocShell*, gfxASurface*, int32_t,
int32_t) override
diff --git a/dom/canvas/nsICanvasRenderingContextInternal.h b/dom/canvas/nsICanvasRenderingContextInternal.h
index 3b1120f..fb1ef7c 100644
--- a/dom/canvas/nsICanvasRenderingContextInternal.h
+++ b/dom/canvas/nsICanvasRenderingContextInternal.h
@@ -81,11 +81,9 @@ public:
return mCanvasElement;
}
-#ifdef DEBUG
- // Useful for testing
- virtual int32_t GetWidth() const = 0;
- virtual int32_t GetHeight() const = 0;
-#endif
+ // Dimensions of the canvas, in pixels.
+ virtual int32_t GetWidth() const = 0;
+ virtual int32_t GetHeight() const = 0;
// Sets the dimensions of the canvas, in pixels. Called
// whenever the size of the element changes.
diff --git a/dom/html/HTMLCanvasElement.cpp b/dom/html/HTMLCanvasElement.cpp
index f326662..68649f5 100644
--- a/dom/html/HTMLCanvasElement.cpp
+++ b/dom/html/HTMLCanvasElement.cpp
@@ -526,18 +526,19 @@ HTMLCanvasElement::ToBlob(JSContext* aCx,
return;
}
-#ifdef DEBUG
if (mCurrentContext) {
// We disallow canvases of width or height zero, and set them to 1, so
// we will have a discrepancy with the sizes of the canvas and the context.
// That discrepancy is OK, the rest are not.
nsIntSize elementSize = GetWidthHeight();
- MOZ_ASSERT(elementSize.width == mCurrentContext->GetWidth() ||
- (elementSize.width == 0 && mCurrentContext->GetWidth() == 1));
- MOZ_ASSERT(elementSize.height == mCurrentContext->GetHeight() ||
- (elementSize.height == 0 && mCurrentContext->GetHeight() == 1));
+ if ((elementSize.width != mCurrentContext->GetWidth() &&
+ (elementSize.width != 0 || mCurrentContext->GetWidth() != 1)) ||
+ (elementSize.height != mCurrentContext->GetHeight() &&
+ (elementSize.height != 0 || mCurrentContext->GetHeight() != 1))) {
+ aRv.Throw(NS_ERROR_FAILURE);
+ return;
+ }
}
-#endif
uint8_t* imageBuffer = nullptr;
int32_t format = 0;
--
2.5.0