Closed Bug 1605554 Opened 2 months ago Closed 2 months ago

Use after free in GetSkImageForSurface

Categories

(Core :: Graphics, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla73
Tracking Status
firefox73 --- fixed

People

(Reporter: alexhenrie24, Assigned: alexhenrie24)

Details

Attachments

(1 file)

GetSkImageForSurface currently says:

sk_sp<SkImage> image =
    SkImage::MakeFromRaster(pixmap, ReleaseTemporarySurface, surf);
if (!image) {
  ReleaseTemporarySurface(nullptr, surf);
  gfxDebug() << "Failed making Skia raster image for temporary surface";
}

// Skia doesn't support RGBX surfaces so ensure that the alpha value is opaque
// white.
MOZ_ASSERT(VerifyRGBXCorners(surf->GetData(), surf->GetSize(), surf->Stride(),
                             surf->GetFormat(), aBounds, aMatrix));

If image is NULL, surf is an invalid pointer and the function can crash while evaluating the arguments to VerifyRGBXCorners. I believe this has been a problem ever since the assertion was added in July 2016 as part of the fix for Bug 1279063.

Assignee: nobody → alexhenrie24
Status: NEW → ASSIGNED
Pushed by ccoroiu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/9e60c8fbb6ec
Fix use after free in GetSkImageForSurface. r=lsalzman
Status: ASSIGNED → RESOLVED
Closed: 2 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla73
You need to log in before you can comment on or make changes to this bug.