Index: third_party/WebKit/Source/core/html/HTMLVideoElement.cpp |
diff --git a/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp b/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp |
index 38bda7926ea21ac560f08d5619230eddac282be7..6847cd14818fe93865e0d8465533e38b48e0f0d8 100644 |
--- a/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp |
+++ b/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp |
@@ -340,7 +340,16 @@ |
exceptionState.throwDOMException(IndexSizeError, String::format("The source %s provided is 0.", sw ? "height" : "width")); |
return ScriptPromise(); |
} |
- return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh), eventTarget.toDOMWindow()->document())); |
+ if (!hasSingleSecurityOrigin()) { |
+ exceptionState.throwSecurityError("The source video contains image data from multiple origins."); |
+ return ScriptPromise(); |
+ } |
+ if (!webMediaPlayer()->didPassCORSAccessCheck() |
+ && eventTarget.toDOMWindow()->document()->securityOrigin()->taintsCanvas(currentSrc())) { |
+ exceptionState.throwSecurityError("Cross-origin access to the source video is denied."); |
+ return ScriptPromise(); |
+ } |
+ return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh))); |
} |
} // namespace blink |