This is an automated email from the git hooks/post-receive script.
pierov pushed a commit to branch tor-browser-91.10.0esr-11.0-1 in repository tor-browser.
commit cab7596edf3046a48a84dc8194b3a19217a40180 Author: Kelsey Gilbert kelsey.gilbert@mozilla.com AuthorDate: Fri May 13 16:25:26 2022 -0400
Bug 1743767 - Tighten bounds and add asserts for row-by-row ReadPixels. r=lsalzman, a=RyanVM --- dom/canvas/WebGLContextGL.cpp | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/dom/canvas/WebGLContextGL.cpp b/dom/canvas/WebGLContextGL.cpp index 86957d730d955..b21bf2f57a98f 100644 --- a/dom/canvas/WebGLContextGL.cpp +++ b/dom/canvas/WebGLContextGL.cpp @@ -1203,13 +1203,20 @@ webgl::ReadPixelsResult WebGLContext::ReadPixelsImpl( desc2.srcOffset = {readX, readY}; desc2.size = {rwSize.x, 1};
- auto row = dest + writeX * bytesPerPixel; - row += writeY * rowStride; - for (const auto j : IntegerRange(size.y)) { + const auto skipBytes = writeX * bytesPerPixel; + const auto usedRowBytes = rwSize.x * bytesPerPixel; + for (const auto j : IntegerRange(rwSize.y)) { desc2.srcOffset.y = readY + j; - DoReadPixelsAndConvert(srcFormat->format, desc2, row, bytesNeeded, - rowStride); - row += rowStride; + const auto destWriteBegin = dest + skipBytes + (writeY + j) * rowStride; + MOZ_RELEASE_ASSERT(dest <= destWriteBegin); + MOZ_RELEASE_ASSERT(destWriteBegin <= dest + availBytes); + + const auto destWriteEnd = destWriteBegin + usedRowBytes; + MOZ_RELEASE_ASSERT(dest <= destWriteEnd); + MOZ_RELEASE_ASSERT(destWriteEnd <= dest + availBytes); + + DoReadPixelsAndConvert(srcFormat->format, desc2, destWriteBegin, + destWriteEnd - destWriteBegin, rowStride); } }