Prevent bad casting in ImageBitmap when calling ArrayBuffer::createOrNull

third_party/WebKit/Source/core/frame/ImageBitmap.cpp

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/ImageBitmap.h"
 
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLVideoElement.h"
 #include "core/html/ImageData.h"
 #include "platform/graphics/skia/SkiaUtils.h"
@@ skipping 90 matching lines @@
   else if (options.resizeQuality() == "medium")
     parsedOptions.resizeQuality = kMedium_SkFilterQuality;
   else if (options.resizeQuality() == "pixelated")
     parsedOptions.resizeQuality = kNone_SkFilterQuality;
   else
     parsedOptions.resizeQuality = kLow_SkFilterQuality;
   return parsedOptions;
 }
 
 bool dstBufferSizeHasOverflow(ParsedOptions options) {
-  CheckedNumeric<size_t> totalBytes = options.cropRect.width();
+  CheckedNumeric<unsigned> totalBytes = options.cropRect.width();
   totalBytes *= options.cropRect.height();
   totalBytes *= options.bytesPerPixel;
   if (!totalBytes.IsValid())
     return true;
 
   if (!options.shouldScaleInput)
     return false;
   totalBytes = options.resizeWidth;
   totalBytes *= options.resizeHeight;
   totalBytes *= options.bytesPerPixel;
   if (!totalBytes.IsValid())
     return true;
 
   return false;
 }
 
 }  // namespace
 
 static PassRefPtr<Uint8Array> copySkImageData(SkImage* input,
                                               const SkImageInfo& info) {
   // The function dstBufferSizeHasOverflow() is being called at the beginning of
   // each ImageBitmap() constructor, which makes sure that doing
-  // width * height * bytesPerPixel will never overflow size_t.
-  size_t width = static_cast<size_t>(input->width());
+  // width * height * bytesPerPixel will never overflow unsigned.
+  unsigned width = static_cast<unsigned>(input->width());
   RefPtr<ArrayBuffer> dstBuffer =
       ArrayBuffer::createOrNull(width * input->height(), info.bytesPerPixel());
   if (!dstBuffer)
     return nullptr;
   RefPtr<Uint8Array> dstPixels =
       Uint8Array::create(dstBuffer, 0, dstBuffer->byteLength());
   input->readPixels(info, dstPixels->data(), width * info.bytesPerPixel(), 0,
                     0);
   return dstPixels;
 }
 
 static sk_sp<SkImage> newSkImageFromRaster(const SkImageInfo& info,
                                            PassRefPtr<Uint8Array> imagePixels,
-                                           size_t imageRowBytes) {
+                                           unsigned imageRowBytes) {
   SkPixmap pixmap(info, imagePixels->data(), imageRowBytes);
   return SkImage::MakeFromRaster(pixmap,
                                  [](const void*, void* pixels) {
                                    static_cast<Uint8Array*>(pixels)->deref();
                                  },
                                  imagePixels.leakRef());
 }
 
 static void swizzleImageData(unsigned char* srcAddr,
-                             size_t height,
-                             size_t bytesPerRow,
+                             unsigned height,
+                             unsigned bytesPerRow,
                              bool flipY) {
   if (flipY) {
-    for (size_t i = 0; i < height / 2; i++) {
-      size_t topRowStartPosition = i * bytesPerRow;
-      size_t bottomRowStartPosition = (height - 1 - i) * bytesPerRow;
+    for (unsigned i = 0; i < height / 2; i++) {
+      unsigned topRowStartPosition = i * bytesPerRow;
+      unsigned bottomRowStartPosition = (height - 1 - i) * bytesPerRow;
       if (kN32_SkColorType == kBGRA_8888_SkColorType) {  // needs to swizzle
-        for (size_t j = 0; j < bytesPerRow; j += 4) {
+        for (unsigned j = 0; j < bytesPerRow; j += 4) {
           std::swap(srcAddr[topRowStartPosition + j],
                     srcAddr[bottomRowStartPosition + j + 2]);
           std::swap(srcAddr[topRowStartPosition + j + 1],
                     srcAddr[bottomRowStartPosition + j + 1]);
           std::swap(srcAddr[topRowStartPosition + j + 2],
                     srcAddr[bottomRowStartPosition + j]);
           std::swap(srcAddr[topRowStartPosition + j + 3],
                     srcAddr[bottomRowStartPosition + j + 3]);
         }
       } else {
         std::swap_ranges(srcAddr + topRowStartPosition,
                          srcAddr + topRowStartPosition + bytesPerRow,
                          srcAddr + bottomRowStartPosition);
       }
     }
   } else {
     if (kN32_SkColorType == kBGRA_8888_SkColorType)  // needs to swizzle
-      for (size_t i = 0; i < height * bytesPerRow; i += 4)
+      for (unsigned i = 0; i < height * bytesPerRow; i += 4)
         std::swap(srcAddr[i], srcAddr[i + 2]);
   }
 }
 
 static sk_sp<SkImage> flipSkImageVertically(SkImage* input,
                                             AlphaDisposition alphaOp) {
-  size_t width = static_cast<size_t>(input->width());
-  size_t height = static_cast<size_t>(input->height());
+  unsigned width = static_cast<unsigned>(input->width());
+  unsigned height = static_cast<unsigned>(input->height());
   SkImageInfo info = SkImageInfo::MakeN32(input->width(), input->height(),
                                           (alphaOp == PremultiplyAlpha)
                                               ? kPremul_SkAlphaType
                                               : kUnpremul_SkAlphaType);
-  size_t imageRowBytes = width * info.bytesPerPixel();
+  unsigned imageRowBytes = width * info.bytesPerPixel();
   RefPtr<Uint8Array> imagePixels = copySkImageData(input, info);
   if (!imagePixels)
     return nullptr;
-  for (size_t i = 0; i < height / 2; i++) {
-    size_t topFirstElement = i * imageRowBytes;
-    size_t topLastElement = (i + 1) * imageRowBytes;
-    size_t bottomFirstElement = (height - 1 - i) * imageRowBytes;
+  for (unsigned i = 0; i < height / 2; i++) {
+    unsigned topFirstElement = i * imageRowBytes;
+    unsigned topLastElement = (i + 1) * imageRowBytes;
+    unsigned bottomFirstElement = (height - 1 - i) * imageRowBytes;
     std::swap_ranges(imagePixels->data() + topFirstElement,
                      imagePixels->data() + topLastElement,
                      imagePixels->data() + bottomFirstElement);
   }
   return newSkImageFromRaster(info, std::move(imagePixels), imageRowBytes);
 }
 
 static sk_sp<SkImage> premulSkImageToUnPremul(SkImage* input) {
   SkImageInfo info = SkImageInfo::Make(input->width(), input->height(),
                                        kN32_SkColorType, kUnpremul_SkAlphaType);
   RefPtr<Uint8Array> dstPixels = copySkImageData(input, info);
   if (!dstPixels)
     return nullptr;
   return newSkImageFromRaster(
       info, std::move(dstPixels),
-      static_cast<size_t>(input->width()) * info.bytesPerPixel());
+      static_cast<unsigned>(input->width()) * info.bytesPerPixel());
 }
 
 static sk_sp<SkImage> unPremulSkImageToPremul(SkImage* input) {
   SkImageInfo info = SkImageInfo::Make(input->width(), input->height(),
                                        kN32_SkColorType, kPremul_SkAlphaType);
   RefPtr<Uint8Array> dstPixels = copySkImageData(input, info);
   if (!dstPixels)
     return nullptr;
   return newSkImageFromRaster(
       info, std::move(dstPixels),
-      static_cast<size_t>(input->width()) * info.bytesPerPixel());
+      static_cast<unsigned>(input->width()) * info.bytesPerPixel());
 }
 
 sk_sp<SkImage> ImageBitmap::getSkImageFromDecoder(
     std::unique_ptr<ImageDecoder> decoder) {
   if (!decoder->frameCount())
     return nullptr;
   ImageFrame* frame = decoder->frameBufferAtIndex(0);
   if (!frame || frame->getStatus() != ImageFrame::FrameComplete)
     return nullptr;
   DCHECK(!frame->bitmap().isNull() && !frame->bitmap().empty());
@@ skipping 40 matching lines @@
   const IntRect srcRect = intersection(imgRect, parsedOptions.cropRect);
 
   // In the case when cropRect doesn't intersect the source image and it
   // requires a umpremul image We immediately return a transparent black image
   // with cropRect.size()
   if (srcRect.isEmpty() && !parsedOptions.premultiplyAlpha) {
     SkImageInfo info =
         SkImageInfo::Make(parsedOptions.resizeWidth, parsedOptions.resizeHeight,
                           kN32_SkColorType, kUnpremul_SkAlphaType);
     RefPtr<ArrayBuffer> dstBuffer = ArrayBuffer::createOrNull(
-        static_cast<size_t>(info.width()) * info.height(),
+        static_cast<unsigned>(info.width()) * info.height(),
         info.bytesPerPixel());
     if (!dstBuffer)
       return nullptr;
     RefPtr<Uint8Array> dstPixels =
         Uint8Array::create(dstBuffer, 0, dstBuffer->byteLength());
     return StaticBitmapImage::create(newSkImageFromRaster(
         info, std::move(dstPixels),
-        static_cast<size_t>(info.width()) * info.bytesPerPixel()));
+        static_cast<unsigned>(info.width()) * info.bytesPerPixel()));
   }
 
   sk_sp<SkImage> skiaImage = image->imageForCurrentFrame();
   // Attempt to get raw unpremultiplied image data, executed only when skiaImage
   // is premultiplied.
   if ((((!parsedOptions.premultiplyAlpha && !skiaImage->isOpaque()) ||
         !skiaImage) &&
        image->data() && imageFormat == PremultiplyAlpha) ||
       colorSpaceOp == ImageDecoder::GammaAndColorProfileIgnored) {
     std::unique_ptr<ImageDecoder> decoder(ImageDecoder::create(
@@ skipping 204 matching lines @@
   SkImageInfo resizedInfo = SkImageInfo::Make(
       resizeWidth, resizeHeight, kN32_SkColorType, kUnpremul_SkAlphaType);
   RefPtr<ArrayBuffer> dstBuffer = ArrayBuffer::createOrNull(
       resizeWidth * resizeHeight, resizedInfo.bytesPerPixel());
   if (!dstBuffer)
     return nullptr;
   RefPtr<Uint8Array> resizedPixels =
       Uint8Array::create(dstBuffer, 0, dstBuffer->byteLength());
   SkPixmap pixmap(
       resizedInfo, resizedPixels->data(),
-      static_cast<size_t>(resizeWidth) * resizedInfo.bytesPerPixel());
+      static_cast<unsigned>(resizeWidth) * resizedInfo.bytesPerPixel());
   skImage->scalePixels(pixmap, resizeQuality);
   return SkImage::MakeFromRaster(pixmap,
                                  [](const void*, void* pixels) {
                                    static_cast<Uint8Array*>(pixels)->deref();
                                  },
                                  resizedPixels.release().leakRef());
 }
 
 ImageBitmap::ImageBitmap(ImageData* data,
                          Optional<IntRect> cropRect,
                          const ImageBitmapOptions& options) {
   // TODO(xidachen): implement the resize option
   IntRect dataSrcRect = IntRect(IntPoint(), data->size());
   ParsedOptions parsedOptions =
       parseOptions(options, cropRect, data->bitmapSourceSize());
   if (dstBufferSizeHasOverflow(parsedOptions))
     return;
   IntRect srcRect = cropRect ? intersection(parsedOptions.cropRect, dataSrcRect)
                              : dataSrcRect;
 
   // treat non-premultiplyAlpha as a special case
   if (!parsedOptions.premultiplyAlpha) {
     unsigned char* srcAddr = data->data()->data();
 
     // Using kN32 type, swizzle input if necessary.
     SkImageInfo info = SkImageInfo::Make(
         parsedOptions.cropRect.width(), parsedOptions.cropRect.height(),
         kN32_SkColorType, kUnpremul_SkAlphaType);
-    size_t bytesPerPixel = static_cast<size_t>(info.bytesPerPixel());
-    size_t srcPixelBytesPerRow = bytesPerPixel * data->size().width();
-    size_t dstPixelBytesPerRow = bytesPerPixel * parsedOptions.cropRect.width();
+    unsigned bytesPerPixel = static_cast<unsigned>(info.bytesPerPixel());
+    unsigned srcPixelBytesPerRow = bytesPerPixel * data->size().width();
+    unsigned dstPixelBytesPerRow =
+        bytesPerPixel * parsedOptions.cropRect.width();
     sk_sp<SkImage> skImage;
     if (parsedOptions.cropRect == IntRect(IntPoint(), data->size())) {
       swizzleImageData(srcAddr, data->size().height(), srcPixelBytesPerRow,
                        parsedOptions.flipY);
       skImage =
           SkImage::MakeRasterCopy(SkPixmap(info, srcAddr, dstPixelBytesPerRow));
       // restore the original ImageData
       swizzleImageData(srcAddr, data->size().height(), srcPixelBytesPerRow,
                        parsedOptions.flipY);
     } else {
       RefPtr<ArrayBuffer> dstBuffer = ArrayBuffer::createOrNull(
-          static_cast<size_t>(parsedOptions.cropRect.height()) *
+          static_cast<unsigned>(parsedOptions.cropRect.height()) *
               parsedOptions.cropRect.width(),
           bytesPerPixel);
       if (!dstBuffer)
         return;
       RefPtr<Uint8Array> copiedDataBuffer =
           Uint8Array::create(dstBuffer, 0, dstBuffer->byteLength());
       if (!srcRect.isEmpty()) {
         IntPoint srcPoint = IntPoint(
             (parsedOptions.cropRect.x() > 0) ? parsedOptions.cropRect.x() : 0,
             (parsedOptions.cropRect.y() > 0) ? parsedOptions.cropRect.y() : 0);
         IntPoint dstPoint = IntPoint(
             (parsedOptions.cropRect.x() >= 0) ? 0 : -parsedOptions.cropRect.x(),
             (parsedOptions.cropRect.y() >= 0) ? 0
                                               : -parsedOptions.cropRect.y());
         int copyHeight = data->size().height() - srcPoint.y();
         if (parsedOptions.cropRect.height() < copyHeight)
           copyHeight = parsedOptions.cropRect.height();
         int copyWidth = data->size().width() - srcPoint.x();
         if (parsedOptions.cropRect.width() < copyWidth)
           copyWidth = parsedOptions.cropRect.width();
         for (int i = 0; i < copyHeight; i++) {
-          size_t srcStartCopyPosition =
+          unsigned srcStartCopyPosition =
               (i + srcPoint.y()) * srcPixelBytesPerRow +
               srcPoint.x() * bytesPerPixel;
-          size_t srcEndCopyPosition =
+          unsigned srcEndCopyPosition =
               srcStartCopyPosition + copyWidth * bytesPerPixel;
-          size_t dstStartCopyPosition;
+          unsigned dstStartCopyPosition;
           if (parsedOptions.flipY)
             dstStartCopyPosition =
                 (parsedOptions.cropRect.height() - 1 - dstPoint.y() - i) *
                     dstPixelBytesPerRow +
                 dstPoint.x() * bytesPerPixel;
           else
             dstStartCopyPosition = (dstPoint.y() + i) * dstPixelBytesPerRow +
                                    dstPoint.x() * bytesPerPixel;
-          for (size_t j = 0; j < srcEndCopyPosition - srcStartCopyPosition;
+          for (unsigned j = 0; j < srcEndCopyPosition - srcStartCopyPosition;
                j++) {
             // swizzle when necessary
             if (kN32_SkColorType == kBGRA_8888_SkColorType) {
               if (j % 4 == 0)
                 copiedDataBuffer->data()[dstStartCopyPosition + j] =
                     srcAddr[srcStartCopyPosition + j + 2];
               else if (j % 4 == 2)
                 copiedDataBuffer->data()[dstStartCopyPosition + j] =
                     srcAddr[srcStartCopyPosition + j - 2];
               else
@@ skipping 240 matching lines @@
 void ImageBitmap::adjustDrawRects(FloatRect* srcRect,
                                   FloatRect* dstRect) const {}
 
 FloatSize ImageBitmap::elementSize(const FloatSize&) const {
   return FloatSize(width(), height());
 }
 
 DEFINE_TRACE(ImageBitmap) {}
 
 }  // namespace blink