Canvas.toDataURL to use SkBitmap::readPixels to avoid uninitialized memory

Source/core/html/HTMLCanvasElement.cpp

 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 445 matching lines @@
         lowercaseMimeType = "image/png";
 
     return lowercaseMimeType;
 }
 
 const AtomicString HTMLCanvasElement::imageSourceURL() const
 {
     return AtomicString(toDataURLInternal("image/png", 0, FrontBuffer));
 }
 
+ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer) const
+{
+    ImageData* imageData;
+    if (is3D()) {
+        // Get non-premultiplied data because of inaccurate premultiplied alpha conversion of buffer()->toDataURL().
+        imageData = m_context->paintRenderingResultsToImageData(sourceBuffer);
+        if (imageData)
+            return imageData;
+
+        m_context->paintRenderingResultsToCanvas(sourceBuffer);
+        imageData = ImageData::create(m_size);
+        SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
+        buffer()->bitmap().readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+        return imageData;
+    }
+
+    imageData = ImageData::create(m_size);
+    ScopedDisposal<ImageData> disposer(imageData);

[Stephen White, 2015/07/16 22:09:41]

It looks like this ScopedDisposal is going to clear the data before
toDataURLInternal() gets a chance to use it. Are you sure this is correct?

+
+    if (m_context) {
+        ASSERT(m_context->is2d());
+        SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
+        buffer()->bitmap().readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+    }
+    return imageData;
+}
+
 String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double* quality, SourceDrawingBuffer sourceBuffer) const
 {
     if (!isPaintable())
         return String("data:,");
 
     String encodingMimeType = toEncodingMimeType(mimeType);
-    if (!m_context) {
-        ImageData* imageData = ImageData::create(m_size);
-        ScopedDisposal<ImageData> disposer(imageData);
-        return ImageDataBuffer(imageData->size(), imageData->data()->data()).toDataURL(encodingMimeType, quality);
-    }
 
-    if (m_context->is3d()) {
-        // Get non-premultiplied data because of inaccurate premultiplied alpha conversion of buffer()->toDataURL().
-        ImageData* imageData = m_context->paintRenderingResultsToImageData(sourceBuffer);
-        ScopedDisposal<ImageData> disposer(imageData);
-        if (imageData)
-            return ImageDataBuffer(imageData->size(), imageData->data()->data()).toDataURL(encodingMimeType, quality);
-        m_context->paintRenderingResultsToCanvas(sourceBuffer);
-    }
+    ImageData* imageData = toImageData(sourceBuffer);
+    ScopedDisposal<ImageData> disposer(imageData);
 
-    return buffer()->toDataURL(encodingMimeType, quality);
+    return ImageDataBuffer(imageData->size(), imageData->data()->data()).toDataURL(encodingMimeType, quality);
 }
 
 String HTMLCanvasElement::toDataURL(const String& mimeType, const ScriptValue& qualityArgument, ExceptionState& exceptionState) const
 {
     if (!originClean()) {
         exceptionState.throwSecurityError("Tainted canvases may not be exported.");
         return String();
     }
     double quality;
     double* qualityPtr = nullptr;
@@ skipping 363 matching lines @@
 {
     return FloatSize(width(), height());
 }
 
 bool HTMLCanvasElement::isOpaque() const
 {
     return m_context && !m_context->hasAlpha();
 }
 
 } // blink