nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
guix-devel/gnu/packages/patches/icecat-CVE-2016-1952-pt01.p...

357 lines
11 KiB
Diff
Raw Blame History

Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/c1d67bd4c993
# HG changeset patch
# User Timothy Nikkel <tnikkel@gmail.com>
# Date 1454023801 21600
# Node ID c1d67bd4c993b9e344c68954e6f0392c82b81e38
# Parent 530559abe159d3c23f078d673d30ff03d9c244e2
Bug 1224979 - Check if we compute usable filters for the downscaler, and if not put the downscaler in error state so it's not used. r=edwin, a=al
diff --git a/image/Downscaler.cpp b/image/Downscaler.cpp
new file mode 100644
--- /dev/null
+++ b/image/Downscaler.cpp
@@ -0,0 +1,340 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "Downscaler.h"
+
+#include <algorithm>
+#include <ctime>
+#include "gfxPrefs.h"
+#include "image_operations.h"
+#include "mozilla/SSE.h"
+#include "convolver.h"
+#include "skia/include/core/SkTypes.h"
+
+using std::max;
+using std::swap;
+
+namespace mozilla {
+namespace image {
+
+Downscaler::Downscaler(const nsIntSize& aTargetSize)
+ : mTargetSize(aTargetSize)
+ , mOutputBuffer(nullptr)
+ , mXFilter(MakeUnique<skia::ConvolutionFilter1D>())
+ , mYFilter(MakeUnique<skia::ConvolutionFilter1D>())
+ , mWindowCapacity(0)
+ , mHasAlpha(true)
+ , mFlipVertically(false)
+{
+ MOZ_ASSERT(gfxPrefs::ImageDownscaleDuringDecodeEnabled(),
+ "Downscaling even though downscale-during-decode is disabled?");
+ MOZ_ASSERT(mTargetSize.width > 0 && mTargetSize.height > 0,
+ "Invalid target size");
+}
+
+Downscaler::~Downscaler()
+{
+ ReleaseWindow();
+}
+
+void
+Downscaler::ReleaseWindow()
+{
+ if (!mWindow) {
+ return;
+ }
+
+ for (int32_t i = 0; i < mWindowCapacity; ++i) {
+ delete[] mWindow[i];
+ }
+
+ mWindow = nullptr;
+ mWindowCapacity = 0;
+}
+
+nsresult
+Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
+ const Maybe<nsIntRect>& aFrameRect,
+ uint8_t* aOutputBuffer,
+ bool aHasAlpha,
+ bool aFlipVertically /* = false */)
+{
+ MOZ_ASSERT(aOutputBuffer);
+ MOZ_ASSERT(mTargetSize != aOriginalSize,
+ "Created a downscaler, but not downscaling?");
+ MOZ_ASSERT(mTargetSize.width <= aOriginalSize.width,
+ "Created a downscaler, but width is larger");
+ MOZ_ASSERT(mTargetSize.height <= aOriginalSize.height,
+ "Created a downscaler, but height is larger");
+ MOZ_ASSERT(aOriginalSize.width > 0 && aOriginalSize.height > 0,
+ "Invalid original size");
+
+ mFrameRect = aFrameRect.valueOr(nsIntRect(nsIntPoint(), aOriginalSize));
+ MOZ_ASSERT(mFrameRect.x >= 0 && mFrameRect.y >= 0 &&
+ mFrameRect.width >= 0 && mFrameRect.height >= 0,
+ "Frame rect must have non-negative components");
+ MOZ_ASSERT(nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
+ .Contains(mFrameRect),
+ "Frame rect must fit inside image");
+ MOZ_ASSERT_IF(!nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
+ .IsEqualEdges(mFrameRect),
+ aHasAlpha);
+
+ mOriginalSize = aOriginalSize;
+ mScale = gfxSize(double(mOriginalSize.width) / mTargetSize.width,
+ double(mOriginalSize.height) / mTargetSize.height);
+ mOutputBuffer = aOutputBuffer;
+ mHasAlpha = aHasAlpha;
+ mFlipVertically = aFlipVertically;
+
+ ReleaseWindow();
+
+ auto resizeMethod = skia::ImageOperations::RESIZE_LANCZOS3;
+
+ skia::resize::ComputeFilters(resizeMethod,
+ mOriginalSize.width, mTargetSize.width,
+ 0, mTargetSize.width,
+ mXFilter.get());
+
+ if (mXFilter->max_filter() <= 0 || mXFilter->num_values() != mTargetSize.width) {
+ NS_WARNING("Failed to compute filters for image downscaling");
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ skia::resize::ComputeFilters(resizeMethod,
+ mOriginalSize.height, mTargetSize.height,
+ 0, mTargetSize.height,
+ mYFilter.get());
+
+ if (mYFilter->max_filter() <= 0 || mYFilter->num_values() != mTargetSize.height) {
+ NS_WARNING("Failed to compute filters for image downscaling");
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // Allocate the buffer, which contains scanlines of the original image.
+ // pad by 15 to handle overreads by the simd code
+ size_t bufferLen = mOriginalSize.width * sizeof(uint32_t) + 15;
+ mRowBuffer.reset(new (fallible) uint8_t[bufferLen]);
+ if (MOZ_UNLIKELY(!mRowBuffer)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // Zero buffer to keep valgrind happy.
+ memset(mRowBuffer.get(), 0, bufferLen);
+
+ // Allocate the window, which contains horizontally downscaled scanlines. (We
+ // can store scanlines which are already downscale because our downscaling
+ // filter is separable.)
+ mWindowCapacity = mYFilter->max_filter();
+ mWindow.reset(new (fallible) uint8_t*[mWindowCapacity]);
+ if (MOZ_UNLIKELY(!mWindow)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ bool anyAllocationFailed = false;
+ // pad by 15 to handle overreads by the simd code
+ const int rowSize = mTargetSize.width * sizeof(uint32_t) + 15;
+ for (int32_t i = 0; i < mWindowCapacity; ++i) {
+ mWindow[i] = new (fallible) uint8_t[rowSize];
+ anyAllocationFailed = anyAllocationFailed || mWindow[i] == nullptr;
+ }
+
+ if (MOZ_UNLIKELY(anyAllocationFailed)) {
+ // We intentionally iterate through the entire array even if an allocation
+ // fails, to ensure that all the pointers in it are either valid or nullptr.
+ // That in turn ensures that ReleaseWindow() can clean up correctly.
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ ResetForNextProgressivePass();
+
+ return NS_OK;
+}
+
+void
+Downscaler::SkipToRow(int32_t aRow)
+{
+ if (mCurrentInLine < aRow) {
+ ClearRow();
+ do {
+ CommitRow();
+ } while (mCurrentInLine < aRow);
+ }
+}
+
+void
+Downscaler::ResetForNextProgressivePass()
+{
+ mPrevInvalidatedLine = 0;
+ mCurrentOutLine = 0;
+ mCurrentInLine = 0;
+ mLinesInBuffer = 0;
+
+ if (mFrameRect.IsEmpty()) {
+ // Our frame rect is zero size; commit rows until the end of the image.
+ SkipToRow(mOriginalSize.height - 1);
+ } else {
+ // If we have a vertical offset, commit rows to shift us past it.
+ SkipToRow(mFrameRect.y);
+ }
+}
+
+static void
+GetFilterOffsetAndLength(UniquePtr<skia::ConvolutionFilter1D>& aFilter,
+ int32_t aOutputImagePosition,
+ int32_t* aFilterOffsetOut,
+ int32_t* aFilterLengthOut)
+{
+ MOZ_ASSERT(aOutputImagePosition < aFilter->num_values());
+ aFilter->FilterForValue(aOutputImagePosition,
+ aFilterOffsetOut,
+ aFilterLengthOut);
+}
+
+void
+Downscaler::ClearRow(uint32_t aStartingAtCol)
+{
+ MOZ_ASSERT(int64_t(mOriginalSize.width) > int64_t(aStartingAtCol));
+ uint32_t bytesToClear = (mOriginalSize.width - aStartingAtCol)
+ * sizeof(uint32_t);
+ memset(mRowBuffer.get() + (aStartingAtCol * sizeof(uint32_t)),
+ 0, bytesToClear);
+}
+
+void
+Downscaler::CommitRow()
+{
+ MOZ_ASSERT(mOutputBuffer, "Should have a current frame");
+ MOZ_ASSERT(mCurrentInLine < mOriginalSize.height, "Past end of input");
+
+ if (mCurrentOutLine < mTargetSize.height) {
+ int32_t filterOffset = 0;
+ int32_t filterLength = 0;
+ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+ &filterOffset, &filterLength);
+
+ int32_t inLineToRead = filterOffset + mLinesInBuffer;
+ MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
+ if (mCurrentInLine == inLineToRead) {
+ skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
+ mWindow[mLinesInBuffer++], mHasAlpha,
+ supports_sse2());
+ }
+
+ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
+ "Writing past end of output");
+
+ while (mLinesInBuffer == filterLength) {
+ DownscaleInputLine();
+
+ if (mCurrentOutLine == mTargetSize.height) {
+ break; // We're done.
+ }
+
+ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+ &filterOffset, &filterLength);
+ }
+ }
+
+ mCurrentInLine += 1;
+
+ // If we're at the end of the part of the original image that has data, commit
+ // rows to shift us to the end.
+ if (mCurrentInLine == (mFrameRect.y + mFrameRect.height)) {
+ SkipToRow(mOriginalSize.height - 1);
+ }
+}
+
+bool
+Downscaler::HasInvalidation() const
+{
+ return mCurrentOutLine > mPrevInvalidatedLine;
+}
+
+DownscalerInvalidRect
+Downscaler::TakeInvalidRect()
+{
+ if (MOZ_UNLIKELY(!HasInvalidation())) {
+ return DownscalerInvalidRect();
+ }
+
+ DownscalerInvalidRect invalidRect;
+
+ // Compute the target size invalid rect.
+ if (mFlipVertically) {
+ // We need to flip it. This will implicitly flip the original size invalid
+ // rect, since we compute it by scaling this rect.
+ invalidRect.mTargetSizeRect =
+ IntRect(0, mTargetSize.height - mCurrentOutLine,
+ mTargetSize.width, mCurrentOutLine - mPrevInvalidatedLine);
+ } else {
+ invalidRect.mTargetSizeRect =
+ IntRect(0, mPrevInvalidatedLine,
+ mTargetSize.width, mCurrentOutLine - mPrevInvalidatedLine);
+ }
+
+ mPrevInvalidatedLine = mCurrentOutLine;
+
+ // Compute the original size invalid rect.
+ invalidRect.mOriginalSizeRect = invalidRect.mTargetSizeRect;
+ invalidRect.mOriginalSizeRect.ScaleRoundOut(mScale.width, mScale.height);
+
+ return invalidRect;
+}
+
+void
+Downscaler::DownscaleInputLine()
+{
+ typedef skia::ConvolutionFilter1D::Fixed FilterValue;
+
+ MOZ_ASSERT(mOutputBuffer);
+ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
+ "Writing past end of output");
+
+ int32_t filterOffset = 0;
+ int32_t filterLength = 0;
+ MOZ_ASSERT(mCurrentOutLine < mYFilter->num_values());
+ auto filterValues =
+ mYFilter->FilterForValue(mCurrentOutLine, &filterOffset, &filterLength);
+
+ int32_t currentOutLine = mFlipVertically
+ ? mTargetSize.height - (mCurrentOutLine + 1)
+ : mCurrentOutLine;
+ MOZ_ASSERT(currentOutLine >= 0);
+
+ uint8_t* outputLine =
+ &mOutputBuffer[currentOutLine * mTargetSize.width * sizeof(uint32_t)];
+ skia::ConvolveVertically(static_cast<const FilterValue*>(filterValues),
+ filterLength, mWindow.get(), mXFilter->num_values(),
+ outputLine, mHasAlpha, supports_sse2());
+
+ mCurrentOutLine += 1;
+
+ if (mCurrentOutLine == mTargetSize.height) {
+ // We're done.
+ return;
+ }
+
+ int32_t newFilterOffset = 0;
+ int32_t newFilterLength = 0;
+ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+ &newFilterOffset, &newFilterLength);
+
+ int diff = newFilterOffset - filterOffset;
+ MOZ_ASSERT(diff >= 0, "Moving backwards in the filter?");
+
+ // Shift the buffer. We're just moving pointers here, so this is cheap.
+ mLinesInBuffer -= diff;
+ mLinesInBuffer = max(mLinesInBuffer, 0);
+ for (int32_t i = 0; i < mLinesInBuffer; ++i) {
+ swap(mWindow[i], mWindow[filterLength - mLinesInBuffer + i]);
+ }
+}
+
+
+
+} // namespace image
+} // namespace mozilla
Reference in New Issue View Git Blame Copy Permalink