Rework the checks for too-few values in feColorMatrix filter.

Source/platform/graphics/filters/FEColorMatrix.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 13 matching lines @@
 #include "config.h"
 #include "platform/graphics/filters/FEColorMatrix.h"
 
 #include "SkColorFilterImageFilter.h"
 #include "SkColorMatrixFilter.h"
 #include "platform/graphics/filters/SkiaImageFilterBuilder.h"
 #include "platform/text/TextStream.h"
 
 namespace blink {
 
+static const unsigned kColorMatrixSize = 20;
+
 FEColorMatrix::FEColorMatrix(Filter* filter, ColorMatrixType type, const Vector<float>& values)
     : FilterEffect(filter)
     , m_type(type)
     , m_values(values)
 {
 }
 
 PassRefPtrWillBeRawPtr<FEColorMatrix> FEColorMatrix::create(Filter* filter, ColorMatrixType type, const Vector<float>& values)
 {
     return adoptRefWillBeNoop(new FEColorMatrix(filter, type, values));
@@ skipping 18 matching lines @@
 }
 
 bool FEColorMatrix::setValues(const Vector<float> &values)
 {
     if (m_values == values)
         return false;
     m_values = values;
     return true;
 }
 
-static void saturateMatrix(float s, SkScalar matrix[20])
+static void saturateMatrix(float s, SkScalar matrix[kColorMatrixSize])
 {
     matrix[0] = 0.213f + 0.787f * s;
     matrix[1] = 0.715f - 0.715f * s;
     matrix[2] = 0.072f - 0.072f * s;
     matrix[3] = matrix[4] = 0;
     matrix[5] = 0.213f - 0.213f * s;
     matrix[6] = 0.715f + 0.285f * s;
     matrix[7] = 0.072f - 0.072f * s;
     matrix[8] = matrix[9] = 0;
     matrix[10] = 0.213f - 0.213f * s;
     matrix[11] = 0.715f - 0.715f * s;
     matrix[12] = 0.072f + 0.928f * s;
     matrix[13] = matrix[14] = 0;
     matrix[15] = matrix[16] = matrix[17] = 0;
     matrix[18] = 1;
     matrix[19] = 0;
 }
 
-static void hueRotateMatrix(float hue, SkScalar matrix[20])
+static void hueRotateMatrix(float hue, SkScalar matrix[kColorMatrixSize])
 {
     float cosHue = cosf(hue * piFloat / 180);
     float sinHue = sinf(hue * piFloat / 180);
     matrix[0] = 0.213f + cosHue * 0.787f - sinHue * 0.213f;
     matrix[1] = 0.715f - cosHue * 0.715f - sinHue * 0.715f;
     matrix[2] = 0.072f - cosHue * 0.072f + sinHue * 0.928f;
     matrix[3] = matrix[4] = 0;
     matrix[5] = 0.213f - cosHue * 0.213f + sinHue * 0.143f;
     matrix[6] = 0.715f + cosHue * 0.285f + sinHue * 0.140f;
     matrix[7] = 0.072f - cosHue * 0.072f - sinHue * 0.283f;
     matrix[8] = matrix[9] = 0;
     matrix[10] = 0.213f - cosHue * 0.213f - sinHue * 0.787f;
     matrix[11] = 0.715f - cosHue * 0.715f + sinHue * 0.715f;
     matrix[12] = 0.072f + cosHue * 0.928f + sinHue * 0.072f;
     matrix[13] = matrix[14] = 0;
     matrix[15] = matrix[16] = matrix[17] = 0;
     matrix[18] = 1;
     matrix[19] = 0;
 }
 
-static void luminanceToAlphaMatrix(SkScalar matrix[20])
+static void luminanceToAlphaMatrix(SkScalar matrix[kColorMatrixSize])
 {
-    memset(matrix, 0, 20 * sizeof(SkScalar));
+    memset(matrix, 0, kColorMatrixSize * sizeof(SkScalar));
     matrix[15] = 0.2125f;
     matrix[16] = 0.7154f;
     matrix[17] = 0.0721f;
 }
 
-static SkColorFilter* createColorFilter(ColorMatrixType type, const float* values)
+static SkColorFilter* createColorFilter(ColorMatrixType type, const Vector<float>& values)
 {
-    SkScalar matrix[20];
+    // Use defaults if values contains too few values. See SVGFEColorMatrixElement::build
+    SkScalar matrix[kColorMatrixSize];
+    memset(matrix, 0, kColorMatrixSize * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = matrix[18] = 1;
+
     switch (type) {
     case FECOLORMATRIX_TYPE_UNKNOWN:
         break;
     case FECOLORMATRIX_TYPE_MATRIX:
-        for (int i = 0; i < 20; ++i)
-            matrix[i] = values[i];
-
+        if (values.size() >= kColorMatrixSize) {
+            for (unsigned i = 0; i < kColorMatrixSize; ++i)
+                matrix[i] = values[i];
+        }
         matrix[4] *= SkScalar(255);
         matrix[9] *= SkScalar(255);
         matrix[14] *= SkScalar(255);
         matrix[19] *= SkScalar(255);
         break;
     case FECOLORMATRIX_TYPE_SATURATE:
-        saturateMatrix(values[0], matrix);
+        if (values.size())
+            saturateMatrix(values[0], matrix);
         break;
     case FECOLORMATRIX_TYPE_HUEROTATE:
-        hueRotateMatrix(values[0], matrix);
+        if (values.size())
+            hueRotateMatrix(values[0], matrix);
         break;
     case FECOLORMATRIX_TYPE_LUMINANCETOALPHA:
         luminanceToAlphaMatrix(matrix);
         break;
     }
     return SkColorMatrixFilter::Create(matrix);
 }
 
 bool FEColorMatrix::affectsTransparentPixels()
 {
     // Because the input pixels are premultiplied, the only way clear pixels can be
     // painted is if the additive component for the alpha is not 0.
-    return m_type == FECOLORMATRIX_TYPE_MATRIX && m_values[19] > 0;
+    return m_type == FECOLORMATRIX_TYPE_MATRIX && m_values.size() >= kColorMatrixSize && m_values[19] > 0;
 }
 
 PassRefPtr<SkImageFilter> FEColorMatrix::createImageFilter(SkiaImageFilterBuilder* builder)
 {
     RefPtr<SkImageFilter> input(builder->build(inputEffect(0), operatingColorSpace()));
-    SkAutoTUnref<SkColorFilter> filter(createColorFilter(m_type, m_values.data()));
+    SkAutoTUnref<SkColorFilter> filter(createColorFilter(m_type, m_values));
     SkImageFilter::CropRect rect = getCropRect(builder->cropOffset());
     return adoptRef(SkColorFilterImageFilter::Create(filter, input.get(), &rect));
 }
 
 static TextStream& operator<<(TextStream& ts, const ColorMatrixType& type)
 {
     switch (type) {
     case FECOLORMATRIX_TYPE_UNKNOWN:
         ts << "UNKNOWN";
         break;
@@ skipping 30 matching lines @@
                 ts << " ";
         }
         ts << "\"";
     }
     ts << "]\n";
     inputEffect(0)->externalRepresentation(ts, indent + 1);
     return ts;
 }
 
 } // namespace blink