Closed
Bug 341280
Opened 18 years ago
Closed 18 years ago
crash if i use negative arguments for getImageData
Categories
(Core :: Graphics: Canvas2D, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: sendmail.to, Assigned: vlad)
Details
(Keywords: fixed1.8.1)
Attachments
(1 file)
1.73 KB,
patch
|
pavlov
:
review+
vlad
:
approval-branch-1.8.1+
|
Details | Diff | Splinter Review |
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060612 Minefield/3.0a1 ID:2006061205 [cairo] GetImageData cause a crash if the sw or sh attribute is negative. var idata = context.getImageData(x,y,5,-15); Sure it was not my intention to use this function like this, but i think we should catch this behavior. Reproducible: Always Getting a MS Visual C++ Runtime Error Box(no usefull information) and then crash Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060530 Minefield/3.0a1 ID:2006053004 [cairo] Simply crashed Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060612 Minefield/3.0a1 ID:2006061205 [cairo] Tested from Chrome Context, and from Webpage Context A full testcase: <html> <head> <script type="text/javascript"> function crashIt(){ var canvas = document.getElementById('bug'); var ctx = canvas.getContext('2d'); var idata = ctx.getImageData(200,200,5,-15); } </script> </head> <body onload="crashIt();"> <canvas id="bug" height="400" width="400"></canvas> </body> </html>
Assignee | ||
Comment 1•18 years ago
|
||
Whoops. Check w/h for <= 0 and bail.
Assignee: nobody → vladimir
Status: UNCONFIRMED → ASSIGNED
Attachment #225301 -
Flags: review?(pavlov)
Updated•18 years ago
|
Attachment #225301 -
Flags: review?(pavlov) → review+
Assignee | ||
Updated•18 years ago
|
Attachment #225301 -
Flags: approval-branch-1.8.1+
Assignee | ||
Updated•18 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•