Security fix while computing dropdown menu arrow width

third_party/WebKit/Source/core/paint/ThemePainterDefault.cpp

 /*
  * Copyright (C) 2007 Apple Inc.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2008 Collabora Ltd.
  * Copyright (C) 2008, 2009 Google Inc.
  * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 24 matching lines @@
 #include "platform/graphics/GraphicsContextStateSaver.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebRect.h"
 #include "public/platform/WebThemeEngine.h"
 
 namespace blink {
 
 namespace {
 
 const unsigned defaultButtonBackgroundColor = 0xffdddddd;
-const unsigned dropdownMenuListArrowPadding = 3;
+const unsigned mockDropdownMenuListArrowPadding = 3;
+// This is equal to the padding provided by the LayoutMenuList which is
+// calculated based on |menuListArrowPaddingSize| in LayoutThemeDefault.
+const unsigned mockDropdownMenuListArrowWidth = 18;
 
 bool useMockTheme()
 {
     return LayoutTestSupport::isMockThemeEnabledForTest();
 }
 
 WebThemeEngine::State getWebThemeState(const LayoutObject& o)
 {
     if (!LayoutTheme::isEnabled(o))
         return WebThemeEngine::StateDisabled;
@@ skipping 200 matching lines @@
 
 void ThemePainterDefault::setupMenuListArrow(const LayoutBox& box, const IntRect& rect, WebThemeEngine::ExtraParams& extraParams)
 {
     const int right = rect.x() + rect.width();
     const int middle = rect.y() + rect.height() / 2;
 
     extraParams.menuList.arrowY = middle;
     if (useMockTheme()) {
         // The size and position of the drop-down button is different between
         // the mock theme and the regular aura theme.
-        int extraPadding = dropdownMenuListArrowPadding * box.styleRef().effectiveZoom();
-        // The width available for the arrow is based on the padding provided
-        // in the child LayoutBox.
-        int arrowBoxWidth = ((box.styleRef().direction() == RTL) ? box.firstChildBox()->paddingLeft() : box.firstChildBox()->paddingRight()).toInt();
+        int extraPadding = mockDropdownMenuListArrowPadding * box.styleRef().effectiveZoom();
+        int arrowBoxWidth = mockDropdownMenuListArrowWidth * box.styleRef().effectiveZoom();
         int arrowSize = std::min(arrowBoxWidth, rect.height()) - 2 * extraPadding;
         extraParams.menuList.arrowX = (box.styleRef().direction() == RTL) ? rect.x() + extraPadding + (arrowSize / 2) : right - (arrowSize / 2) - extraPadding;
         extraParams.menuList.arrowSize = arrowSize;
     } else {
         const int arrowSize = 6;
         const int arrowPadding = 6;
         extraParams.menuList.arrowX = (box.styleRef().direction() == RTL)
             ? rect.x() + arrowPadding * box.styleRef().effectiveZoom() + box.borderLeft()
             : right - (arrowSize + arrowPadding) * box.styleRef().effectiveZoom() - box.borderRight();
         extraParams.menuList.arrowSize = arrowSize * box.styleRef().effectiveZoom();
@@ skipping 115 matching lines @@
         cancelButtonSize, cancelButtonSize);
     IntRect paintingRect = convertToPaintingRect(inputLayoutBox, cancelButtonObject, cancelButtonRect, r);
 
     DEFINE_STATIC_REF(Image, cancelImage, (Image::loadPlatformResource("searchCancel")));
     DEFINE_STATIC_REF(Image, cancelPressedImage, (Image::loadPlatformResource("searchCancelPressed")));
     paintInfo.context.drawImage(LayoutTheme::isPressed(cancelButtonObject) ? cancelPressedImage : cancelImage, paintingRect);
     return false;
 }
 
 } // namespace blink