| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2008 Apple Inc. All rights reserved. | 2 * Copyright (C) 2008 Apple Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * | 7 * |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 16 matching lines...) Expand all Loading... |
| 27 */ | 27 */ |
| 28 | 28 |
| 29 #include "core/html/ImageData.h" | 29 #include "core/html/ImageData.h" |
| 30 | 30 |
| 31 #include "bindings/core/v8/ExceptionState.h" | 31 #include "bindings/core/v8/ExceptionState.h" |
| 32 #include "bindings/core/v8/V8Uint8ClampedArray.h" | 32 #include "bindings/core/v8/V8Uint8ClampedArray.h" |
| 33 #include "core/dom/ExceptionCode.h" | 33 #include "core/dom/ExceptionCode.h" |
| 34 #include "core/frame/ImageBitmap.h" | 34 #include "core/frame/ImageBitmap.h" |
| 35 #include "core/imagebitmap/ImageBitmapOptions.h" | 35 #include "core/imagebitmap/ImageBitmapOptions.h" |
| 36 #include "platform/RuntimeEnabledFeatures.h" | 36 #include "platform/RuntimeEnabledFeatures.h" |
| 37 #include "wtf/CheckedNumeric.h" | |
| 38 | 37 |
| 39 namespace blink { | 38 namespace blink { |
| 40 | 39 |
| 41 ImageData* ImageData::create(const IntSize& size) | 40 ImageData* ImageData::create(const IntSize& size) |
| 42 { | 41 { |
| 43 CheckedNumeric<int> dataSize = 4; | 42 Checked<int, RecordOverflow> dataSize = 4; |
| 44 dataSize *= size.width(); | 43 dataSize *= size.width(); |
| 45 dataSize *= size.height(); | 44 dataSize *= size.height(); |
| 46 if (!dataSize.IsValid() || dataSize.ValueOrDie() < 0) | 45 if (dataSize.hasOverflowed() || dataSize.unsafeGet() < 0) |
| 47 return nullptr; | 46 return nullptr; |
| 48 | 47 |
| 49 RefPtr<DOMUint8ClampedArray> byteArray = DOMUint8ClampedArray::createOrNull(
dataSize.ValueOrDie()); | 48 RefPtr<DOMUint8ClampedArray> byteArray = |
| 49 DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet()); |
| 50 if (!byteArray) | 50 if (!byteArray) |
| 51 return nullptr; | 51 return nullptr; |
| 52 | 52 |
| 53 return new ImageData(size, byteArray.release()); | 53 return new ImageData(size, byteArray.release()); |
| 54 } | 54 } |
| 55 | 55 |
| 56 ImageData* ImageData::create(const IntSize& size, PassRefPtr<DOMUint8ClampedArra
y> byteArray) | 56 ImageData* ImageData::create(const IntSize& size, PassRefPtr<DOMUint8ClampedArra
y> byteArray) |
| 57 { | 57 { |
| 58 CheckedNumeric<int> dataSize = 4; | 58 Checked<int, RecordOverflow> dataSize = 4; |
| 59 dataSize *= size.width(); | 59 dataSize *= size.width(); |
| 60 dataSize *= size.height(); | 60 dataSize *= size.height(); |
| 61 if (!dataSize.IsValid()) | 61 if (dataSize.hasOverflowed()) |
| 62 return nullptr; | 62 return nullptr; |
| 63 | 63 |
| 64 if (dataSize.ValueOrDie() < 0 | 64 if (dataSize.unsafeGet() < 0 |
| 65 || static_cast<unsigned>(dataSize.ValueOrDie()) > byteArray->length()) | 65 || static_cast<unsigned>(dataSize.unsafeGet()) > byteArray->length()) |
| 66 return nullptr; | 66 return nullptr; |
| 67 | 67 |
| 68 return new ImageData(size, byteArray); | 68 return new ImageData(size, byteArray); |
| 69 } | 69 } |
| 70 | 70 |
| 71 ImageData* ImageData::create(unsigned width, unsigned height, ExceptionState& ex
ceptionState) | 71 ImageData* ImageData::create(unsigned width, unsigned height, ExceptionState& ex
ceptionState) |
| 72 { | 72 { |
| 73 if (!width || !height) { | 73 if (!width || !height) { |
| 74 exceptionState.throwDOMException(IndexSizeError, String::format("The sou
rce %s is zero or not a number.", width ? "height" : "width")); | 74 exceptionState.throwDOMException(IndexSizeError, String::format("The sou
rce %s is zero or not a number.", width ? "height" : "width")); |
| 75 return nullptr; | 75 return nullptr; |
| 76 } | 76 } |
| 77 | 77 |
| 78 CheckedNumeric<unsigned> dataSize = 4; | 78 Checked<unsigned, RecordOverflow> dataSize = 4; |
| 79 dataSize *= width; | 79 dataSize *= width; |
| 80 dataSize *= height; | 80 dataSize *= height; |
| 81 if (!dataSize.IsValid() | 81 if (dataSize.hasOverflowed() |
| 82 || static_cast<int>(width) < 0 | 82 || static_cast<int>(width) < 0 |
| 83 || static_cast<int>(height) < 0) { | 83 || static_cast<int>(height) < 0) { |
| 84 exceptionState.throwDOMException(IndexSizeError, "The requested image si
ze exceeds the supported range."); | 84 exceptionState.throwDOMException(IndexSizeError, "The requested image si
ze exceeds the supported range."); |
| 85 return nullptr; | 85 return nullptr; |
| 86 } | 86 } |
| 87 | 87 |
| 88 RefPtr<DOMUint8ClampedArray> byteArray = DOMUint8ClampedArray::createOrNull(
dataSize.ValueOrDie()); | 88 RefPtr<DOMUint8ClampedArray> byteArray = |
| 89 DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet()); |
| 89 if (!byteArray) { | 90 if (!byteArray) { |
| 90 exceptionState.throwDOMException(V8GeneralError, "Out of memory at Image
Data creation"); | 91 exceptionState.throwDOMException(V8GeneralError, "Out of memory at Image
Data creation"); |
| 91 return nullptr; | 92 return nullptr; |
| 92 } | 93 } |
| 93 | 94 |
| 94 return new ImageData(IntSize(width, height), byteArray.release()); | 95 return new ImageData(IntSize(width, height), byteArray.release()); |
| 95 } | 96 } |
| 96 | 97 |
| 97 bool ImageData::validateConstructorArguments(DOMUint8ClampedArray* data, unsigne
d width, unsigned& lengthInPixels, ExceptionState& exceptionState) | 98 bool ImageData::validateConstructorArguments(DOMUint8ClampedArray* data, unsigne
d width, unsigned& lengthInPixels, ExceptionState& exceptionState) |
| 98 { | 99 { |
| (...skipping 82 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 181 ASSERT(size.width() >= 0 && size.height() >= 0); | 182 ASSERT(size.width() >= 0 && size.height() >= 0); |
| 182 ASSERT_WITH_SECURITY_IMPLICATION(static_cast<unsigned>(size.width() * size.h
eight() * 4) <= m_data->length()); | 183 ASSERT_WITH_SECURITY_IMPLICATION(static_cast<unsigned>(size.width() * size.h
eight() * 4) <= m_data->length()); |
| 183 } | 184 } |
| 184 | 185 |
| 185 void ImageData::dispose() | 186 void ImageData::dispose() |
| 186 { | 187 { |
| 187 m_data.clear(); | 188 m_data.clear(); |
| 188 } | 189 } |
| 189 | 190 |
| 190 } // namespace blink | 191 } // namespace blink |
| OLD | NEW |