- Revision
- 203274
- Author
- [email protected]
- Date
- 2016-07-15 05:38:37 -0700 (Fri, 15 Jul 2016)
Log Message
Uninitialized variable in DIBPixelData can cause a dangerous memory write
https://bugs.webkit.org/show_bug.cgi?id=159414
Reviewed by Brent Fulgham.
Source/WebCore:
Initialize local BITMAP variable, in case the ::GetObject function that should initialize it
fails to do so, because the bitmap handle is invalid.
Tests: Tools/TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp
* platform/graphics/win/DIBPixelData.cpp:
(WebCore::DIBPixelData::initialize): Initialize local variable.
(WebCore::DIBPixelData::setRGBABitmapAlpha): Return early if we have no bitmap.
* platform/graphics/win/DIBPixelData.h: Link fix.
Tools:
Add test to check that DIBPixelData::setRGBABitmapAlpha does not cause a crash
when the HDC parameter is invalid.
* TestWebKitAPI/PlatformWin.cmake:
* TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp: Added.
(TestWebKitAPI::TEST):
Modified Paths
Added Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (203273 => 203274)
--- trunk/Source/WebCore/ChangeLog 2016-07-15 10:21:33 UTC (rev 203273)
+++ trunk/Source/WebCore/ChangeLog 2016-07-15 12:38:37 UTC (rev 203274)
@@ -1,3 +1,20 @@
+2016-07-15 Per Arne Vollan <[email protected]>
+
+ Uninitialized variable in DIBPixelData can cause a dangerous memory write
+ https://bugs.webkit.org/show_bug.cgi?id=159414
+
+ Reviewed by Brent Fulgham.
+
+ Initialize local BITMAP variable, in case the ::GetObject function that should initialize it
+ fails to do so, because the bitmap handle is invalid.
+
+ Tests: Tools/TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp
+
+ * platform/graphics/win/DIBPixelData.cpp:
+ (WebCore::DIBPixelData::initialize): Initialize local variable.
+ (WebCore::DIBPixelData::setRGBABitmapAlpha): Return early if we have no bitmap.
+ * platform/graphics/win/DIBPixelData.h: Link fix.
+
2016-07-14 Yoav Weiss <[email protected]>
Change CSSParser::sourceSize returning Optional<CSSParser::SourceSize>
Modified: trunk/Source/WebCore/platform/graphics/win/DIBPixelData.cpp (203273 => 203274)
--- trunk/Source/WebCore/platform/graphics/win/DIBPixelData.cpp 2016-07-15 10:21:33 UTC (rev 203273)
+++ trunk/Source/WebCore/platform/graphics/win/DIBPixelData.cpp 2016-07-15 12:38:37 UTC (rev 203274)
@@ -38,7 +38,7 @@
void DIBPixelData::initialize(HBITMAP bitmap)
{
- BITMAP bmpInfo;
+ BITMAP bmpInfo = {0, 0, 0, 0, 0, 0, nullptr};
GetObject(bitmap, sizeof(bmpInfo), &bmpInfo);
m_bitmapBuffer = reinterpret_cast<UInt8*>(bmpInfo.bmBits);
@@ -87,6 +87,10 @@
void DIBPixelData::setRGBABitmapAlpha(HDC hdc, const IntRect& dstRect, unsigned char level)
{
HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+
+ if (!bitmap)
+ return;
+
DIBPixelData pixelData(bitmap);
ASSERT(pixelData.bitsPerPixel() == 32);
Modified: trunk/Source/WebCore/platform/graphics/win/DIBPixelData.h (203273 => 203274)
--- trunk/Source/WebCore/platform/graphics/win/DIBPixelData.h 2016-07-15 10:21:33 UTC (rev 203273)
+++ trunk/Source/WebCore/platform/graphics/win/DIBPixelData.h 2016-07-15 12:38:37 UTC (rev 203274)
@@ -60,7 +60,7 @@
const IntSize& size() const { return m_size; }
unsigned bytesPerRow() const { return m_bytesPerRow; }
unsigned short bitsPerPixel() const { return m_bitsPerPixel; }
- static void setRGBABitmapAlpha(HDC, const IntRect&, unsigned char);
+ WEBCORE_EXPORT static void setRGBABitmapAlpha(HDC, const IntRect&, unsigned char);
private:
UInt8* m_bitmapBuffer;
Modified: trunk/Tools/ChangeLog (203273 => 203274)
--- trunk/Tools/ChangeLog 2016-07-15 10:21:33 UTC (rev 203273)
+++ trunk/Tools/ChangeLog 2016-07-15 12:38:37 UTC (rev 203274)
@@ -1,3 +1,17 @@
+2016-07-15 Per Arne Vollan <[email protected]>
+
+ Uninitialized variable in DIBPixelData can cause a dangerous memory write
+ https://bugs.webkit.org/show_bug.cgi?id=159414
+
+ Reviewed by Brent Fulgham.
+
+ Add test to check that DIBPixelData::setRGBABitmapAlpha does not cause a crash
+ when the HDC parameter is invalid.
+
+ * TestWebKitAPI/PlatformWin.cmake:
+ * TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp: Added.
+ (TestWebKitAPI::TEST):
+
2016-07-15 Carlos Garcia Campos <[email protected]>
[GTK] Add basic tabs support to MiniBrowser
Modified: trunk/Tools/TestWebKitAPI/PlatformWin.cmake (203273 => 203274)
--- trunk/Tools/TestWebKitAPI/PlatformWin.cmake 2016-07-15 10:21:33 UTC (rev 203273)
+++ trunk/Tools/TestWebKitAPI/PlatformWin.cmake 2016-07-15 12:38:37 UTC (rev 203274)
@@ -48,6 +48,7 @@
${TESTWEBKITAPI_DIR}/Tests/WebCore/SharedBuffer.cpp
${TESTWEBKITAPI_DIR}/Tests/WebCore/TimeRanges.cpp
${TESTWEBKITAPI_DIR}/Tests/WebCore/URL.cpp
+ ${TESTWEBKITAPI_DIR}/Tests/WebCore/win/DIBPixelData.cpp
)
if (${WTF_PLATFORM_WIN_CAIRO})
Added: trunk/Tools/TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp (0 => 203274)
--- trunk/Tools/TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp (rev 0)
+++ trunk/Tools/TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp 2016-07-15 12:38:37 UTC (rev 203274)
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <WebCore/DIBPixelData.h>
+
+using namespace WebCore;
+
+namespace TestWebKitAPI {
+
+// This test passes if DIBPixelData::setRGBABitmapAlpha does not crash when the HDC parameter is null.
+
+TEST(WebCore, DIBPixelDataInvalidHdcTest)
+{
+ DIBPixelData::setRGBABitmapAlpha(nullptr, IntRect(), 0);
+}
+
+} // namespace TestWebKitAPI
