306090 - SVG security review: image->image conversions

Status: RESOLVED WONTFIX

(Core :: SVG, defect)

Description

[Jesse Ruderman]

T Rowley mentioned that this is part of the SVG attack surface and could do with
a security review:

  * image->image conversions
http://lxr.mozilla.org/mozilla/source/layout/generic/nsImageFrame.cpp

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I assume that this is supposed to be nsSVGImageFrame.cpp
(http://lxr.mozilla.org/mozilla/source/layout/svg/base/src/nsSVGImageFrame.cpp)
and not layout/generic/nsImageFrame.cpp, right?

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

nsSVGImageFrame::ConvertFrame looks fine, though some of the array offset
wrangling could be a bit more efficient (probably irrelevant with a good
compiler).  A lot of code similar to this will eventually be shared via Thebes.

Comment 3

[Jonathan Watt [:jwatt]]

Is this something we should keep open and pursue at this point?

Comment 4

[Jonathan Watt [:jwatt]]

Feel free to reopen if this is going to actually happen.