Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

8319079: Missing range checks in decora #1272

Closed
wants to merge 4 commits into from

Conversation

jayathirthrao
Copy link
Member

@jayathirthrao jayathirthrao commented Oct 30, 2023

In SW pipeline path of Box/Gaussian Blur/Shadow effects we are not checking for range when we read data from the source/destination buffers in native code.

We need to add appropriate range checks in native JNI code also apart from range checks in Java side to make sure that wherever these JNI methods are used we are not performing out of bounds access.


Progress

  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue
  • Change must be properly reviewed (2 reviews required, with at least 1 Reviewer, 1 Author)

Issue

  • JDK-8319079: Missing range checks in decora (Bug - P3)

Reviewers

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jfx.git pull/1272/head:pull/1272
$ git checkout pull/1272

Update a local copy of the PR:
$ git checkout pull/1272
$ git pull https://git.openjdk.org/jfx.git pull/1272/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 1272

View PR using the GUI difftool:
$ git pr show -t 1272

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jfx/pull/1272.diff

Webrev

Link to Webrev Comment

@bridgekeeper
Copy link

bridgekeeper bot commented Oct 30, 2023

👋 Welcome back jdv! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk openjdk bot added the rfr Ready for review label Oct 30, 2023
@mlbridge
Copy link

mlbridge bot commented Oct 30, 2023

Webrevs

Comment on lines 121 to 133
if (srcPixels_arr == NULL ||
dstPixels_arr == NULL ||
srccols <= 0 ||
srcrows <= 0 ||
srccols > INT_MAX / srcrows ||
dstcols <= 0 ||
dstrows <= 0 ||
dstcols > INT_MAX / dstrows ||
(srccols * srcrows) > env->GetArrayLength(srcPixels_arr) ||
(dstcols * dstrows) > env->GetArrayLength(dstPixels_arr) ||
dstrows > srcrows) { // We should not move out of source vertical bounds
return;
}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of copy-pasting the same checks in all the missing places, isn't it better to create a check method (say in SSEUtils) and call if from all the places? Like in the style of java.util.Objects::checkRange.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the checks are identical, that could be a useful change.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the inputs.
Apart from single check all others are identical, so i have added common utility function.

@kevinrushforth
Copy link
Member

/reviewers 2

@openjdk
Copy link

openjdk bot commented Oct 30, 2023

@kevinrushforth
The total number of required reviews for this PR (including the jcheck configuration and the last /reviewers command) is now set to 2 (with at least 1 Reviewer, 1 Author).

Copy link
Member

@kevinrushforth kevinrushforth left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. I left one suggestion and will reapprove if you make the change.

@@ -183,3 +183,21 @@ void fsample(jfloat *map,
}
}
}

bool checkRange(JNIEnv *env,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be helpful to add a comment indicating that this will return true if the range check fails and false if it is OK.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kevinrushforth thanks for your inputs. I thought for sometime about how to name this function like notInRange() or outOfRange() but since it is checking so many parameters i didn't change function name. I have added comment about what the function is doing as pointed by you.

Also @arapte mentioned a small nit offline about how we can keep src/dst arguments on same line instead of dividing them. I have updated that also.

@openjdk
Copy link

openjdk bot commented Nov 2, 2023

@jayathirthrao This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8319079: Missing range checks in decora

Reviewed-by: kcr, arapte

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 7 new commits pushed to the master branch:

  • ead1953: 8187314: All Cells: must show backing data always
  • bb06b64: 8185831: Pseudo selectors do not appear to work in Node.lookupAll()
  • f41e3ec: 8316419: [macos] Setting X/Y makes Stage maximization not work before show
  • 72c052e: 8319231: Unrecognized "minimum" key in .jcheck/conf causes /reviewers command to be ignored
  • 6104113: 8317836: FX nodes embedded in JFXPanel need to track component orientation
  • a11faa9: 8319066: Application window not always activated in macOS 14 Sonoma
  • f0246b8: 8311216: DataURI can lose information in some charset environments

Please see this link for an up-to-date comparison between the source branch of this pull request and the master branch.
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@kevinrushforth, @arapte) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

@openjdk openjdk bot added the ready Ready to be integrated label Nov 2, 2023
@jayathirthrao
Copy link
Member Author

/integrate

@openjdk openjdk bot added the sponsor Ready to sponsor label Nov 2, 2023
@openjdk
Copy link

openjdk bot commented Nov 2, 2023

@jayathirthrao
Your change (at version 69739db) is now ready to be sponsored by a Committer.

@nlisker
Copy link
Collaborator

nlisker commented Nov 2, 2023

/sponsor

@openjdk
Copy link

openjdk bot commented Nov 2, 2023

Going to push as commit 96e5d10.
Since your change was applied there have been 7 commits pushed to the master branch:

  • ead1953: 8187314: All Cells: must show backing data always
  • bb06b64: 8185831: Pseudo selectors do not appear to work in Node.lookupAll()
  • f41e3ec: 8316419: [macos] Setting X/Y makes Stage maximization not work before show
  • 72c052e: 8319231: Unrecognized "minimum" key in .jcheck/conf causes /reviewers command to be ignored
  • 6104113: 8317836: FX nodes embedded in JFXPanel need to track component orientation
  • a11faa9: 8319066: Application window not always activated in macOS 14 Sonoma
  • f0246b8: 8311216: DataURI can lose information in some charset environments

Your commit was automatically rebased without conflicts.

@openjdk openjdk bot added the integrated Pull request has been integrated label Nov 2, 2023
@openjdk openjdk bot closed this Nov 2, 2023
@openjdk openjdk bot removed ready Ready to be integrated rfr Ready for review sponsor Ready to sponsor labels Nov 2, 2023
@openjdk
Copy link

openjdk bot commented Nov 2, 2023

@nlisker @jayathirthrao Pushed as commit 96e5d10.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
integrated Pull request has been integrated
4 participants