Title: [199993] releases/WebKitGTK/webkit-2.12/Source/WebCore
- Revision
- 199993
- Author
- [email protected]
- Date
- 2016-04-25 05:01:17 -0700 (Mon, 25 Apr 2016)
Log Message
Merge r199243 - Timing attack on SVG feComposite filter circumvents same-origin policy
https://bugs.webkit.org/show_bug.cgi?id=154338
Patch by Said Abou-Hallawa <sabouhallawa@apple,com> on 2016-04-08
Reviewed by Oliver Hunt.
Ensure the FEComposite arithmetic filter is clamping the resulted color
components in a constant time.
* platform/graphics/filters/FEComposite.cpp:
(WebCore::clampByte):
(WebCore::computeArithmeticPixels):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (199992 => 199993)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-25 11:57:32 UTC (rev 199992)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-25 12:01:17 UTC (rev 199993)
@@ -1,3 +1,17 @@
+2016-04-08 Said Abou-Hallawa <sabouhallawa@apple,com>
+
+ Timing attack on SVG feComposite filter circumvents same-origin policy
+ https://bugs.webkit.org/show_bug.cgi?id=154338
+
+ Reviewed by Oliver Hunt.
+
+ Ensure the FEComposite arithmetic filter is clamping the resulted color
+ components in a constant time.
+
+ * platform/graphics/filters/FEComposite.cpp:
+ (WebCore::clampByte):
+ (WebCore::computeArithmeticPixels):
+
2016-04-07 Brent Fulgham <[email protected]>
Wheel event callback removing the window causes crash in WebCore.
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/graphics/filters/FEComposite.cpp (199992 => 199993)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/graphics/filters/FEComposite.cpp 2016-04-25 11:57:32 UTC (rev 199992)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/graphics/filters/FEComposite.cpp 2016-04-25 12:01:17 UTC (rev 199993)
@@ -120,6 +120,13 @@
forceValidPreMultipliedPixels();
}
+
+static unsigned char clampByte(int c)
+{
+ unsigned char buff[] = { static_cast<unsigned char>(c), 255, 0 };
+ unsigned uc = static_cast<unsigned>(c);
+ return buff[!!(uc & ~0xff) + !!(uc & ~(~0u >> 1))];
+}
template <int b1, int b4>
static inline void computeArithmeticPixels(unsigned char* source, unsigned char* destination, int pixelArrayLength,
@@ -141,12 +148,7 @@
if (b4)
result += scaledK4;
- if (result <= 0)
- *destination = 0;
- else if (result >= 255)
- *destination = 255;
- else
- *destination = result;
+ *destination = clampByte(result);
++source;
++destination;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
