Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(92)

Side by Side Diff: third_party/WebKit/Source/platform/graphics/BitmapImage.cpp

Issue 2173873003: Cancel image loads if decoding failed (attempt #2) (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Fix UAF Created 4 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com) 2 * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
3 * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved. 3 * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
4 * 4 *
5 * Redistribution and use in source and binary forms, with or without 5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions 6 * modification, are permitted provided that the following conditions
7 * are met: 7 * are met:
8 * 1. Redistributions of source code must retain the above copyright 8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer. 9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright 10 * 2. Redistributions in binary form must reproduce the above copyright
(...skipping 171 matching lines...) Expand 10 before | Expand all | Expand 10 after
182 { 182 {
183 updateSize(); 183 updateSize();
184 return m_sizeRespectingOrientation; 184 return m_sizeRespectingOrientation;
185 } 185 }
186 186
187 bool BitmapImage::getHotSpot(IntPoint& hotSpot) const 187 bool BitmapImage::getHotSpot(IntPoint& hotSpot) const
188 { 188 {
189 return m_source.getHotSpot(hotSpot); 189 return m_source.getHotSpot(hotSpot);
190 } 190 }
191 191
192 bool BitmapImage::setData(PassRefPtr<SharedBuffer> data, bool allDataReceived) 192 Image::SizeAvailability BitmapImage::setData(PassRefPtr<SharedBuffer> data, bool allDataReceived)
193 { 193 {
194 if (!data.get()) 194 if (!data.get())
195 return true; 195 return SizeAvailable;
196 196
197 int length = data->size(); 197 int length = data->size();
198 if (!length) 198 if (!length)
199 return true; 199 return SizeAvailable;
200 200
201 m_source.setData(*data, allDataReceived); 201 // If ImageSource::setData() returns Invalid, we know that this is a decode error.
202 // Report size available so that it gets registered as such in ImageResource .
203 if (m_source.setData(*data, allDataReceived) == ImageDecoder::SniffResult::I nvalid)
204 return SizeAvailable;
202 205
203 return dataChanged(allDataReceived); 206 return dataChanged(allDataReceived);
204 } 207 }
205 208
206 bool BitmapImage::dataChanged(bool allDataReceived) 209 Image::SizeAvailability BitmapImage::dataChanged(bool allDataReceived)
207 { 210 {
208 TRACE_EVENT0("blink", "BitmapImage::dataChanged"); 211 TRACE_EVENT0("blink", "BitmapImage::dataChanged");
209 212
210 // Clear all partially-decoded frames. For most image formats, there is only 213 // Clear all partially-decoded frames. For most image formats, there is only
211 // one frame, but at least GIF and ICO can have more. With GIFs, the frames 214 // one frame, but at least GIF and ICO can have more. With GIFs, the frames
212 // come in order and we ask to decode them in order, waiting to request a 215 // come in order and we ask to decode them in order, waiting to request a
213 // subsequent frame until the prior one is complete. Given that we clear 216 // subsequent frame until the prior one is complete. Given that we clear
214 // incomplete frames here, this means there is at most one incomplete frame 217 // incomplete frames here, this means there is at most one incomplete frame
215 // (even if we use destroyDecodedData() -- since it doesn't reset the 218 // (even if we use destroyDecodedData() -- since it doesn't reset the
216 // metadata), and it is after all the complete frames. 219 // metadata), and it is after all the complete frames.
(...skipping 15 matching lines...) Expand all
232 m_frames[i].clear(true); 235 m_frames[i].clear(true);
233 if (i == m_cachedFrameIndex) 236 if (i == m_cachedFrameIndex)
234 m_cachedFrame.clear(); 237 m_cachedFrame.clear();
235 } 238 }
236 } 239 }
237 240
238 // Feed all the data we've seen so far to the image decoder. 241 // Feed all the data we've seen so far to the image decoder.
239 m_allDataReceived = allDataReceived; 242 m_allDataReceived = allDataReceived;
240 243
241 m_haveFrameCount = false; 244 m_haveFrameCount = false;
242 return isSizeAvailable(); 245 return isSizeAvailable() ? SizeAvailable : SizeUnavailable;
243 } 246 }
244 247
245 bool BitmapImage::hasColorProfile() const 248 bool BitmapImage::hasColorProfile() const
246 { 249 {
247 return m_source.hasColorProfile(); 250 return m_source.hasColorProfile();
248 } 251 }
249 252
250 String BitmapImage::filenameExtension() const 253 String BitmapImage::filenameExtension() const
251 { 254 {
252 return m_source.filenameExtension(); 255 return m_source.filenameExtension();
(...skipping 354 matching lines...) Expand 10 before | Expand all | Expand 10 after
607 610
608 // We need to draw this frame if we advanced to it while not skipping, or if 611 // We need to draw this frame if we advanced to it while not skipping, or if
609 // while trying to skip frames we hit the last frame and thus had to stop. 612 // while trying to skip frames we hit the last frame and thus had to stop.
610 if (skippingFrames != advancedAnimation) 613 if (skippingFrames != advancedAnimation)
611 getImageObserver()->animationAdvanced(this); 614 getImageObserver()->animationAdvanced(this);
612 615
613 return advancedAnimation; 616 return advancedAnimation;
614 } 617 }
615 618
616 } // namespace blink 619 } // namespace blink
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698