1605554 - Use after free in GetSkImageForSurface

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Alex Henrie]

GetSkImageForSurface currently says:

sk_sp<SkImage> image =
    SkImage::MakeFromRaster(pixmap, ReleaseTemporarySurface, surf);
if (!image) {
  ReleaseTemporarySurface(nullptr, surf);
  gfxDebug() << "Failed making Skia raster image for temporary surface";
}

// Skia doesn't support RGBX surfaces so ensure that the alpha value is opaque
// white.
MOZ_ASSERT(VerifyRGBXCorners(surf->GetData(), surf->GetSize(), surf->Stride(),
                             surf->GetFormat(), aBounds, aMatrix));

If image is NULL, surf is an invalid pointer and the function can crash while evaluating the arguments to VerifyRGBXCorners. I believe this has been a problem ever since the assertion was added in July 2016 as part of the fix for Bug 1279063.

Comment 1

[Alex Henrie]

Attachment: Bug 1605554 - Fix use after free in GetSkImageForSurface.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9e60c8fbb6ec
Fix use after free in GetSkImageForSurface. r=lsalzman

Comment 3

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/9e60c8fbb6ec