mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-04-29 07:48:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Check for overflow when creating ImageData

Browse source 
We would overwise crash on overflow.
This commit is contained in:
Shannon Booth 2024-11-14 09:26:41 +13:00 • committed by Tim Flynn
parent 25c067872c
commit 3b04c983f1
Notes: github-actions[bot] 2024-11-14 00:24:16 +00:00
5 changed files with 487 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Libraries/LibWeb/HTML/ImageData.cpp
View file

@ -29,7 +29,15 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<ImageData>> ImageData::create(JS::Realm& re
// 2. Initialize this given sw, sh, and settings set to settings.
// 3. Initialize the image data of this to transparent black.
auto data = TRY(JS::Uint8ClampedArray::create(realm, sw * sh * 4));
//
// If the Canvas Pixel ArrayBuffer cannot be allocated, then rethrow the RangeError thrown by JavaScript, and return.
Checked<u32> size = sw;
size *= sh;
size *= sizeof(u32);
if (size.has_overflow())
return WebIDL::IndexSizeError::create(realm, "The specified image size could not created"_string);
auto data = TRY(JS::Uint8ClampedArray::create(realm, size.value()));
auto bitmap = TRY_OR_THROW_OOM(vm, Gfx::Bitmap::create_wrapper(Gfx::BitmapFormat::RGBA8888, Gfx::AlphaType::Unpremultiplied, Gfx::IntSize(sw, sh), sw * sizeof(u32), data->data().data()));
return realm.create<ImageData>(realm, bitmap, data);