Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Cherry-pick 267815.608@safari-7617-branch (e09e3cd). https://bugs.web…
…kit.org/show_bug.cgi?id=264978 heap-buffer-overflow: crash under WebCore::ShadowBlur::blurLayerImage(). https://bugs.webkit.org/show_bug.cgi?id=264978 rdar://118004762. Reviewed by Simon Fraser. For very large box-shadow sizes due to floating point precision error, ImageBuffer::getPixelBuffer returns 'PixelBuffer' size which is not same as passed size.This causes buffer overflow/underflow issue for these large sizes. In order to fix it now we use same size as allocated 'PixelBuffer' size even though it could be slightly different than original size. * LayoutTests/fast/box-shadow/large-shadowblur-no-crash-expected.txt: Added test expected file. * LayoutTests/fast/box-shadow/large-shadowblur-no-crash.html: Added test case. * Source/WebCore/platform/graphics/ShadowBlur.cpp: (WebCore::ShadowBlur::blurShadowBuffer): Using same size as allocated pixel buffer size. Canonical link: https://commits.webkit.org/267815.608@safari-7617-branch
- Loading branch information