[webkit-changes] [219935] branches/safari-604-branch/Source/WebCore

Wed, 26 Jul 2017 02:52:57 -0700

Title: [219935] branches/safari-604-branch/Source/WebCore

Diff

Modified: branches/safari-604-branch/Source/WebCore/ChangeLog (219934 => 219935)


--- branches/safari-604-branch/Source/WebCore/ChangeLog	2017-07-26 09:52:20 UTC (rev 219934)
+++ branches/safari-604-branch/Source/WebCore/ChangeLog	2017-07-26 09:52:23 UTC (rev 219935)
@@ -1,5 +1,40 @@
 2017-07-26  Jason Marcell  <[email protected]>
 
+        Cherry-pick r219738. rdar://problem/33523826
+
+    2017-07-21  Said Abou-Hallawa  <[email protected]>
+
+            [CG] An image should not invoke many system calls before confirming its format is supported
+            https://bugs.webkit.org/show_bug.cgi?id=174692
+
+            Reviewed by Tim Horton.
+
+            We should be careful when invoking system calls before confirming that the
+            image type is available and it is one of the whitelist formats. Otherwise
+            we will be calling the parsers of the unsupported formats.
+
+            * loader/cache/CachedImage.cpp:
+            (WebCore::CachedImage::setImageDataBuffer): The check isAllowedImageUTI()
+            is now done in ImageDecoder::encodedDataStatus() which will return Error
+            if there is an error in the data or "isAllowedImageUTI() returns false."
+
+            * platform/graphics/BitmapImage.cpp:
+            (WebCore::BitmapImage::dataChanged): Avoid calling canUseAsyncDecodingForLargeImages()
+            before confirming the image type is available and it's supported by WebKit.
+            canUseAsyncDecodingForLargeImages() tries to cache the first frame of the
+            image to know its size. Asking the ImageFrameCache to destroy its decoded
+            frames is not needed unless ImageFrameCache::decodedSize() is not zero.
+
+            * platform/graphics/cg/ImageDecoderCG.cpp:
+            (WebCore::ImageDecoder::encodedDataStatus): Avoid calling CGImageSourceGetStatus()
+            before knowing the UTI of the image. When knowing it, we call CGImageSourceGetStatus()
+            and if it returns kCGImageStatusIncomplete or kCGImageStatusComplete, we
+            check whether isAllowedImageUTI() or not. If isAllowedImageUTI() returns
+            false, return Error which will make the CachedImage cancel loading the
+            rest of the image.
+
+2017-07-26  Jason Marcell  <[email protected]>
+
         Cherry-pick r219829. rdar://problem/33523803
 
     2017-07-24  Simon Fraser  <[email protected]>

Modified: branches/safari-604-branch/Source/WebCore/loader/cache/CachedImage.cpp (219934 => 219935)


--- branches/safari-604-branch/Source/WebCore/loader/cache/CachedImage.cpp	2017-07-26 09:52:20 UTC (rev 219934)
+++ branches/safari-604-branch/Source/WebCore/loader/cache/CachedImage.cpp	2017-07-26 09:52:23 UTC (rev 219935)
@@ -51,7 +51,6 @@
 
 #if USE(CG)
 #include "PDFDocumentImage.h"
-#include "UTIRegistry.h"
 #endif
 
 namespace WebCore {
@@ -440,12 +439,7 @@
 
 EncodedDataStatus CachedImage::setImageDataBuffer(SharedBuffer* data, bool allDataReceived)
 {
-    EncodedDataStatus encodedDataStatus = m_image ? m_image->setData(data, allDataReceived) : EncodedDataStatus::Error;
-#if USE(CG)
-    if (encodedDataStatus >= EncodedDataStatus::TypeAvailable && m_image->isBitmapImage() && !isAllowedImageUTI(m_image->uti()))
-        return EncodedDataStatus::Error;
-#endif
-    return encodedDataStatus;
+    return m_image ? m_image->setData(data, allDataReceived) : EncodedDataStatus::Error;
 }
 
 void CachedImage::addDataBuffer(SharedBuffer& data)

Modified: branches/safari-604-branch/Source/WebCore/platform/graphics/BitmapImage.cpp (219934 => 219935)


--- branches/safari-604-branch/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-07-26 09:52:20 UTC (rev 219934)
+++ branches/safari-604-branch/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-07-26 09:52:23 UTC (rev 219935)
@@ -107,7 +107,7 @@
 
 EncodedDataStatus BitmapImage::dataChanged(bool allDataReceived)
 {
-    if (!canUseAsyncDecodingForLargeImages())
+    if (m_source.decodedSize() && !canUseAsyncDecodingForLargeImages())
         m_source.destroyIncompleteDecodedData();
 
     m_currentFrameDecodingStatus = ImageFrame::DecodingStatus::Invalid;

Modified: branches/safari-604-branch/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp (219934 => 219935)


--- branches/safari-604-branch/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-07-26 09:52:20 UTC (rev 219934)
+++ branches/safari-604-branch/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-07-26 09:52:23 UTC (rev 219935)
@@ -36,6 +36,7 @@
 #include "Logging.h"
 #include "SharedBuffer.h"
 #include <wtf/NeverDestroyed.h>
+#include "UTIRegistry.h"
 
 #if !PLATFORM(IOS)
 #include <ApplicationServices/ApplicationServices.h>
@@ -186,6 +187,10 @@
 
 EncodedDataStatus ImageDecoder::encodedDataStatus() const
 {
+    String uti = this->uti();
+    if (uti.isEmpty())
+        return EncodedDataStatus::Unknown;
+
     switch (CGImageSourceGetStatus(m_nativeDecoder.get())) {
     case kCGImageStatusUnknownType:
         return EncodedDataStatus::Error;
@@ -200,6 +205,9 @@
         return EncodedDataStatus::Error;
 
     case kCGImageStatusIncomplete: {
+        if (!isAllowedImageUTI(uti))
+            return EncodedDataStatus::Error;
+
         RetainPtr<CFDictionaryRef> image0Properties = adoptCF(CGImageSourceCopyPropertiesAtIndex(m_nativeDecoder.get(), 0, imageSourceOptions().get()));
         if (!image0Properties)
             return EncodedDataStatus::TypeAvailable;
@@ -211,6 +219,9 @@
     }
 
     case kCGImageStatusComplete:
+        if (!isAllowedImageUTI(uti))
+            return EncodedDataStatus::Error;
+
         return EncodedDataStatus::Complete;
     }
 

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to