diff options
Diffstat (limited to 'gnu/packages/patches/icecat-CVE-2015-2738.patch')
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2015-2738.patch | 151 |
1 files changed, 151 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-2738.patch b/gnu/packages/patches/icecat-CVE-2015-2738.patch new file mode 100644 index 0000000000..beb784c615 --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2015-2738.patch @@ -0,0 +1,151 @@ +From cda807c21650d0678761d6af8fd324ce622962d6 Mon Sep 17 00:00:00 2001 +From: Andrew Comminos <acomminos@mozilla.com> +Date: Fri, 19 Jun 2015 11:32:17 -0400 +Subject: [PATCH] Bug 1167356 - Handle return value of DataSourceSurface::Map + wherever possible. r=Bas, a=abillings CLOSED TREE + +--- + gfx/2d/SourceSurfaceD2D1.cpp | 11 +++++++++-- + gfx/gl/GLScreenBuffer.cpp | 5 ++++- + gfx/gl/SharedSurfaceGL.cpp | 5 ++++- + gfx/layers/YCbCrImageDataSerializer.cpp | 4 +++- + gfx/layers/opengl/CompositorOGL.cpp | 6 +++++- + gfx/thebes/gfxPlatform.cpp | 6 ++++-- + widget/gtk/nsImageToPixbuf.cpp | 4 +++- + 7 files changed, 32 insertions(+), 9 deletions(-) + +diff --git a/gfx/2d/SourceSurfaceD2D1.cpp b/gfx/2d/SourceSurfaceD2D1.cpp +index fc64327..01f3a67 100644 +--- a/gfx/2d/SourceSurfaceD2D1.cpp ++++ b/gfx/2d/SourceSurfaceD2D1.cpp +@@ -5,6 +5,7 @@ + + #include "SourceSurfaceD2D1.h" + #include "DrawTargetD2D1.h" ++#include "Logging.h" + #include "Tools.h" + + namespace mozilla { +@@ -156,7 +157,10 @@ DataSourceSurfaceD2D1::Map(MapType aMapType, MappedSurface *aMappedSurface) + } + + D2D1_MAPPED_RECT map; +- mBitmap->Map(D2D1_MAP_OPTIONS_READ, &map); ++ if (FAILED(mBitmap->Map(D2D1_MAP_OPTIONS_READ, &map))) { ++ gfxCriticalError() << "Failed to map bitmap."; ++ return false; ++ } + aMappedSurface->mData = map.bits; + aMappedSurface->mStride = map.pitch; + +@@ -189,7 +193,10 @@ DataSourceSurfaceD2D1::EnsureMapped() + if (mMapped) { + return; + } +- mBitmap->Map(D2D1_MAP_OPTIONS_READ, &mMap); ++ if (FAILED(mBitmap->Map(D2D1_MAP_OPTIONS_READ, &mMap))) { ++ gfxCriticalError() << "Failed to map bitmap."; ++ return; ++ } + mMapped = true; + } + +diff --git a/gfx/gl/GLScreenBuffer.cpp b/gfx/gl/GLScreenBuffer.cpp +index 432bdbc..d31e848 100755 +--- a/gfx/gl/GLScreenBuffer.cpp ++++ b/gfx/gl/GLScreenBuffer.cpp +@@ -483,7 +483,10 @@ GLScreenBuffer::Readback(SharedSurface_GL* src, DataSourceSurface* dest) + { + MOZ_ASSERT(src && dest); + DataSourceSurface::MappedSurface ms; +- dest->Map(DataSourceSurface::MapType::READ, &ms); ++ if (!dest->Map(DataSourceSurface::MapType::READ, &ms)) { ++ NS_ERROR("Failed to map surface for reading."); ++ return; ++ } + nsRefPtr<gfxImageSurface> wrappedDest = + new gfxImageSurface(ms.mData, + ThebesIntSize(dest->GetSize()), +diff --git a/gfx/gl/SharedSurfaceGL.cpp b/gfx/gl/SharedSurfaceGL.cpp +index 1aab56f..1f80c28 100644 +--- a/gfx/gl/SharedSurfaceGL.cpp ++++ b/gfx/gl/SharedSurfaceGL.cpp +@@ -326,7 +326,10 @@ SharedSurface_Basic::Fence() + ScopedBindFramebuffer autoFB(mGL, mFB); + + DataSourceSurface::MappedSurface map; +- mData->Map(DataSourceSurface::MapType::WRITE, &map); ++ if (!mData->Map(DataSourceSurface::MapType::WRITE, &map)) { ++ NS_ERROR("Failed to map surface for writing."); ++ return; ++ } + nsRefPtr<gfxImageSurface> wrappedData = + new gfxImageSurface(map.mData, + ThebesIntSize(mData->GetSize()), +diff --git a/gfx/layers/YCbCrImageDataSerializer.cpp b/gfx/layers/YCbCrImageDataSerializer.cpp +index e16db18..6e7a908 100644 +--- a/gfx/layers/YCbCrImageDataSerializer.cpp ++++ b/gfx/layers/YCbCrImageDataSerializer.cpp +@@ -278,7 +278,9 @@ YCbCrImageDataDeserializer::ToDataSourceSurface() + Factory::CreateDataSourceSurface(GetYSize(), gfx::SurfaceFormat::B8G8R8X8); + + DataSourceSurface::MappedSurface map; +- result->Map(DataSourceSurface::MapType::WRITE, &map); ++ if (NS_WARN_IF(!result->Map(DataSourceSurface::MapType::WRITE, &map))) { ++ return nullptr; ++ } + + gfx::ConvertYCbCrToRGB32(GetYData(), GetCbData(), GetCrData(), + map.mData, +diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp +index 92432c3..2e0b51e 100644 +--- a/gfx/layers/opengl/CompositorOGL.cpp ++++ b/gfx/layers/opengl/CompositorOGL.cpp +@@ -1346,7 +1346,11 @@ CompositorOGL::CopyToTarget(DrawTarget *aTarget, const gfx::Matrix& aTransform) + Factory::CreateDataSourceSurface(rect.Size(), gfx::SurfaceFormat::B8G8R8A8); + + DataSourceSurface::MappedSurface map; +- source->Map(DataSourceSurface::MapType::WRITE, &map); ++ if (!source->Map(DataSourceSurface::MapType::WRITE, &map)) { ++ NS_ERROR("Failed to map surface for writing!"); ++ return; ++ } ++ + // XXX we should do this properly one day without using the gfxImageSurface + nsRefPtr<gfxImageSurface> surf = + new gfxImageSurface(map.mData, +diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp +index c869e53..8a2122c 100644 +--- a/gfx/thebes/gfxPlatform.cpp ++++ b/gfx/thebes/gfxPlatform.cpp +@@ -662,8 +662,10 @@ CopySurface(gfxASurface* aSurface) + } + + DataSourceSurface::MappedSurface map; +- DebugOnly<bool> result = data->Map(DataSourceSurface::WRITE, &map); +- MOZ_ASSERT(result, "Should always succeed mapping raw data surfaces!"); ++ if (!data->Map(DataSourceSurface::WRITE, &map)) { ++ NS_ERROR("Failed to map surface for reading!"); ++ return nullptr; ++ } + + nsRefPtr<gfxImageSurface> image = new gfxImageSurface(map.mData, size, map.mStride, format); + nsRefPtr<gfxContext> ctx = new gfxContext(image); +diff --git a/widget/gtk/nsImageToPixbuf.cpp b/widget/gtk/nsImageToPixbuf.cpp +index ca05b3b..a83a570 100644 +--- a/widget/gtk/nsImageToPixbuf.cpp ++++ b/widget/gtk/nsImageToPixbuf.cpp +@@ -75,7 +75,9 @@ nsImageToPixbuf::SourceSurfaceToPixbuf(SourceSurface* aSurface, + + RefPtr<DataSourceSurface> dataSurface = aSurface->GetDataSurface(); + DataSourceSurface::MappedSurface map; +- dataSurface->Map(DataSourceSurface::MapType::READ, &map); ++ if (!dataSurface->Map(DataSourceSurface::MapType::READ, &map)) ++ return nullptr; ++ + uint8_t* srcData = map.mData; + int32_t srcStride = map.mStride; + +-- +2.4.3 + |