Closed Bug 341280 Opened 18 years ago Closed 18 years ago

crash if i use negative arguments for getImageData

Categories

(Core :: Graphics: Canvas2D, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: sendmail.to, Assigned: vlad)

Details

(Keywords: fixed1.8.1)

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060612 Minefield/3.0a1 ID:2006061205 [cairo]

GetImageData cause a crash if the sw or sh attribute is negative.

var idata = context.getImageData(x,y,5,-15); 

Sure it was not my intention to use this function like this, but i think we should catch this behavior.

Reproducible: Always






Getting a MS Visual C++ Runtime Error Box(no usefull information) and then crash
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060530 Minefield/3.0a1 ID:2006053004 [cairo]

Simply crashed
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060612 Minefield/3.0a1 ID:2006061205 [cairo]

Tested from Chrome Context, and from Webpage Context

A full testcase:

<html>
  <head>
    <script type="text/javascript">
      function crashIt(){
        var canvas = document.getElementById('bug');
        var ctx = canvas.getContext('2d');
        var idata = ctx.getImageData(200,200,5,-15); 
      }  
    </script>
  </head>
  <body onload="crashIt();">
    <canvas id="bug"  height="400" width="400"></canvas>
  </body>
</html>
Whoops.  Check w/h for <= 0 and bail.
Assignee: nobody → vladimir
Status: UNCONFIRMED → ASSIGNED
Attachment #225301 - Flags: review?(pavlov)
Attachment #225301 - Flags: review?(pavlov) → review+
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: