Reject createImageBitmap promise when the cropRect or resize is too big

third_party/WebKit/Source/core/frame/ImageBitmap.cpp

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/ImageBitmap.h"
 
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLVideoElement.h"
 #include "core/html/ImageData.h"
 #include "platform/graphics/AcceleratedStaticBitmapImage.h"
 #include "platform/graphics/skia/SkiaUtils.h"
 #include "platform/image-decoders/ImageDecoder.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkSurface.h"
+#include "wtf/CheckedNumeric.h"
 #include "wtf/PtrUtil.h"
 #include "wtf/RefPtr.h"
 #include <memory>
 
 namespace blink {
 
 static const char* imageOrientationFlipY = "flipY";
 static const char* imageBitmapOptionNone = "none";
 
 namespace {
@@ skipping 69 matching lines @@
         parsedOptions.resizeQuality = kHigh_SkFilterQuality;
     else if (options.resizeQuality() == "medium")
         parsedOptions.resizeQuality = kMedium_SkFilterQuality;
     else if (options.resizeQuality() == "pixelated")
         parsedOptions.resizeQuality = kNone_SkFilterQuality;
     else
         parsedOptions.resizeQuality = kLow_SkFilterQuality;
     return parsedOptions;
 }
 
+bool couldDstSizeOverflow(int width, int height)

[Justin Novosad, 2016/08/18 16:42:14]

DstBufferSizeHasOverflow

[xidachen, 2016/08/22 12:02:28]

Done.

+{
+    CheckedNumeric<int> totalBytes = width;

[Justin Novosad, 2016/08/18 16:42:14]

Why int and not size_t? If there is code somewhere that does compute the buffer
size using "int" perhaps we should fix it.

[xidachen, 2016/08/22 12:02:28]

Done.

+    totalBytes *= height;
+    if (!totalBytes.IsValid())

[Justin Novosad, 2016/08/18 16:42:14]

This one is not necessary.  Just check is Valid at the end is sufficient.

[xidachen, 2016/08/22 12:02:28]

Done.

+        return true;
+    totalBytes *= 4;

[Justin Novosad, 2016/08/18 16:42:14]

This hardcoded 4 is dangerous. We will soon support high bit depth options.  You
should query the bytesPerPixel info from an SkImageInfo struct.

[xidachen, 2016/08/22 12:02:28]

Done.

+    if (!totalBytes.IsValid())
+        return true;
+    return false;
+}
+
 } // namespace
 
 static std::unique_ptr<uint8_t[]> copySkImageData(SkImage* input, const SkImageInfo& info)
 {
     std::unique_ptr<uint8_t[]> dstPixels = wrapArrayUnique(new uint8_t[input->width() * input->height() * info.bytesPerPixel()]);
     input->readPixels(info, dstPixels.get(), input->width() * info.bytesPerPixel(), 0, 0);
     return dstPixels;
 }
 
 static PassRefPtr<SkImage> newSkImageFromRaster(const SkImageInfo& info, std::unique_ptr<uint8_t[]> imagePixels, int imageRowBytes)
@@ skipping 168 matching lines @@
             return StaticBitmapImage::create(unPremulSkImageToPremul(skiaImage.get()));
         return StaticBitmapImage::create(skiaImage.release());
     }
     return StaticBitmapImage::create(premulSkImageToUnPremul(skiaImage.get()));
 }
 
 ImageBitmap::ImageBitmap(HTMLImageElement* image, Optional<IntRect> cropRect, Document* document, const ImageBitmapOptions& options)
 {
     RefPtr<Image> input = image->cachedImage()->getImage();
     ParsedOptions parsedOptions = parseOptions(options, cropRect, image->bitmapSourceSize());
+    if (couldDstSizeOverflow(parsedOptions.cropRect.width(), parsedOptions.cropRect.height()))

[Justin Novosad, 2016/08/18 16:42:14]

This repeated bit of code could be made simpler if you just passed parsedOptions
to the function and put both 'if' statements in the function (the scaled case
and non scaled case)

[xidachen, 2016/08/22 12:02:28]

Moving the check to the place where overflow occurs would deprecate this issue.

+        return;
+    if (parsedOptions.shouldScaleInput && couldDstSizeOverflow(parsedOptions.resizeWidth, parsedOptions.resizeHeight))
+        return;
 
     if (options.colorSpaceConversion() == "none")
         m_image = cropImage(input.get(), parsedOptions, PremultiplyAlpha, ImageDecoder::GammaAndColorProfileIgnored);
     else
         m_image = cropImage(input.get(), parsedOptions, PremultiplyAlpha, ImageDecoder::GammaAndColorProfileApplied);
     if (!m_image)
         return;
     // In the case where the source image is lazy-decoded, m_image may not be in
     // a decoded state, we trigger it here.
     RefPtr<SkImage> skImage = m_image->imageForCurrentFrame();
     SkPixmap pixmap;
     if (!skImage->isTextureBacked() && !skImage->peekPixels(&pixmap)) {
         sk_sp<SkSurface> surface = SkSurface::MakeRasterN32Premul(skImage->width(), skImage->height());
         surface->getCanvas()->drawImage(skImage.get(), 0, 0);
         m_image = StaticBitmapImage::create(fromSkSp(surface->makeImageSnapshot()));
     }
     m_image->setOriginClean(!image->wouldTaintOrigin(document->getSecurityOrigin()));
     m_image->setPremultiplied(parsedOptions.premultiplyAlpha);
 }
 
 ImageBitmap::ImageBitmap(HTMLVideoElement* video, Optional<IntRect> cropRect, Document* document, const ImageBitmapOptions& options)
 {
     IntSize playerSize;
     if (video->webMediaPlayer())
         playerSize = video->webMediaPlayer()->naturalSize();
     ParsedOptions parsedOptions = parseOptions(options, cropRect, video->bitmapSourceSize());
+    if (couldDstSizeOverflow(parsedOptions.cropRect.width(), parsedOptions.cropRect.height()))
+        return;
+    if (parsedOptions.shouldScaleInput && couldDstSizeOverflow(parsedOptions.resizeWidth, parsedOptions.resizeHeight))
+        return;
 
     IntRect videoRect = IntRect(IntPoint(), playerSize);
     IntRect srcRect = intersection(parsedOptions.cropRect, videoRect);
     std::unique_ptr<ImageBuffer> buffer = ImageBuffer::create(IntSize(parsedOptions.resizeWidth, parsedOptions.resizeHeight), NonOpaque, DoNotInitializeImagePixels);
     if (!buffer)
         return;
 
     if (parsedOptions.flipY) {
         buffer->canvas()->translate(0, buffer->size().height());
         buffer->canvas()->scale(1, -1);
@@ skipping 16 matching lines @@
     m_image = StaticBitmapImage::create(skiaImage.release());
     m_image->setOriginClean(!video->wouldTaintOrigin(document->getSecurityOrigin()));
     m_image->setPremultiplied(parsedOptions.premultiplyAlpha);
 }
 
 ImageBitmap::ImageBitmap(HTMLCanvasElement* canvas, Optional<IntRect> cropRect, const ImageBitmapOptions& options)
 {
     ASSERT(canvas->isPaintable());
     RefPtr<Image> input = canvas->copiedImage(BackBuffer, PreferAcceleration);
     ParsedOptions parsedOptions = parseOptions(options, cropRect, canvas->bitmapSourceSize());
+    if (couldDstSizeOverflow(parsedOptions.cropRect.width(), parsedOptions.cropRect.height()))
+        return;
+    if (parsedOptions.shouldScaleInput && couldDstSizeOverflow(parsedOptions.resizeWidth, parsedOptions.resizeHeight))
+        return;
 
     bool isPremultiplyAlphaReverted = false;
     if (!parsedOptions.premultiplyAlpha) {
         parsedOptions.premultiplyAlpha = true;
         isPremultiplyAlphaReverted = true;
     }
     m_image = cropImage(input.get(), parsedOptions);
     if (!m_image)
         return;
     if (isPremultiplyAlphaReverted) {
@@ skipping 22 matching lines @@
         {
             delete[] static_cast<const uint8_t*>(pixels);
         }, nullptr));
 }
 
 ImageBitmap::ImageBitmap(ImageData* data, Optional<IntRect> cropRect, const ImageBitmapOptions& options)
 {
     // TODO(xidachen): implement the resize option
     IntRect dataSrcRect = IntRect(IntPoint(), data->size());
     ParsedOptions parsedOptions = parseOptions(options, cropRect, data->bitmapSourceSize());
+    if (couldDstSizeOverflow(parsedOptions.cropRect.width(), parsedOptions.cropRect.height()))
+        return;
+    if (parsedOptions.shouldScaleInput && couldDstSizeOverflow(parsedOptions.resizeWidth, parsedOptions.resizeHeight))
+        return;
     IntRect srcRect = cropRect ? intersection(parsedOptions.cropRect, dataSrcRect) : dataSrcRect;
 
     // treat non-premultiplyAlpha as a special case
     if (!parsedOptions.premultiplyAlpha) {
         unsigned char* srcAddr = data->data()->data();
         int srcHeight = data->size().height();
         int dstHeight = parsedOptions.cropRect.height();
 
         // Using kN32 type, swizzle input if necessary.
         SkImageInfo info = SkImageInfo::Make(parsedOptions.cropRect.width(), dstHeight, kN32_SkColorType, kUnpremul_SkAlphaType);
@@ skipping 79 matching lines @@
     }
     m_image = StaticBitmapImage::create(skImage);
 }
 
 ImageBitmap::ImageBitmap(ImageBitmap* bitmap, Optional<IntRect> cropRect, const ImageBitmapOptions& options)
 {
     RefPtr<Image> input = bitmap->bitmapImage();
     if (!input)
         return;
     ParsedOptions parsedOptions = parseOptions(options, cropRect, input->size());
+    if (couldDstSizeOverflow(parsedOptions.cropRect.width(), parsedOptions.cropRect.height()))
+        return;
+    if (parsedOptions.shouldScaleInput && couldDstSizeOverflow(parsedOptions.resizeWidth, parsedOptions.resizeHeight))
+        return;
 
     m_image = cropImage(input.get(), parsedOptions, bitmap->isPremultiplied() ? PremultiplyAlpha : DontPremultiplyAlpha);
     if (!m_image)
         return;
     m_image->setOriginClean(bitmap->originClean());
     m_image->setPremultiplied(parsedOptions.premultiplyAlpha);
 }
 
 ImageBitmap::ImageBitmap(PassRefPtr<StaticBitmapImage> image, Optional<IntRect> cropRect, const ImageBitmapOptions& options)
 {
     bool originClean = image->originClean();
     RefPtr<Image> input = image;
     ParsedOptions parsedOptions = parseOptions(options, cropRect, input->size());
+    if (couldDstSizeOverflow(parsedOptions.cropRect.width(), parsedOptions.cropRect.height()))
+        return;
+    if (parsedOptions.shouldScaleInput && couldDstSizeOverflow(parsedOptions.resizeWidth, parsedOptions.resizeHeight))
+        return;
 
     m_image = cropImage(input.get(), parsedOptions, DontPremultiplyAlpha);
     if (!m_image)
         return;
     m_image->setOriginClean(originClean);
     m_image->setPremultiplied(parsedOptions.premultiplyAlpha);
 }
 
 ImageBitmap::ImageBitmap(PassRefPtr<StaticBitmapImage> image)
 {
@@ skipping 134 matching lines @@
 FloatSize ImageBitmap::elementSize(const FloatSize&) const
 {
     return FloatSize(width(), height());
 }
 
 DEFINE_TRACE(ImageBitmap)
 {
 }
 
 } // namespace blink