diff options
Diffstat (limited to 'gnu/packages/patches/icecat-CVE-2015-7189.patch')
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2015-7189.patch | 143 |
1 files changed, 143 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-7189.patch b/gnu/packages/patches/icecat-CVE-2015-7189.patch new file mode 100644 index 0000000000..329d1b6f1f --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2015-7189.patch @@ -0,0 +1,143 @@ +From 377e1cefec0fcf230caafb97b4414c835d27c7fe Mon Sep 17 00:00:00 2001 +From: Milan Sreckovic <milan@mozilla.com> +Date: Fri, 2 Oct 2015 09:18:26 +0200 +Subject: [PATCH] Bug 1205900 - Compare context and canvas element sizes before + extracting the data. r=gwright, a=al + +--HG-- +extra : source : f6c99c8baa9b0b6a34d6791e5d4031a2de8f2087 +--- + dom/canvas/CanvasRenderingContext2D.cpp | 2 -- + dom/canvas/CanvasRenderingContext2D.h | 7 +++---- + dom/canvas/WebGLContext.cpp | 2 -- + dom/canvas/WebGLContext.h | 3 +-- + dom/canvas/nsICanvasRenderingContextInternal.h | 8 +++----- + dom/html/HTMLCanvasElement.cpp | 13 +++++++------ + 6 files changed, 14 insertions(+), 21 deletions(-) + +diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp +index d9eaf99..a06fbce 100644 +--- a/dom/canvas/CanvasRenderingContext2D.cpp ++++ b/dom/canvas/CanvasRenderingContext2D.cpp +@@ -1418,7 +1418,6 @@ CanvasRenderingContext2D::EnsureTarget(RenderingMode aRenderingMode) + return mode; + } + +-#ifdef DEBUG + int32_t + CanvasRenderingContext2D::GetWidth() const + { +@@ -1430,7 +1429,6 @@ CanvasRenderingContext2D::GetHeight() const + { + return mHeight; + } +-#endif + + NS_IMETHODIMP + CanvasRenderingContext2D::SetDimensions(int32_t width, int32_t height) +diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h +index af29c78..e853987 100644 +--- a/dom/canvas/CanvasRenderingContext2D.h ++++ b/dom/canvas/CanvasRenderingContext2D.h +@@ -481,10 +481,9 @@ public: + + nsresult Redraw(); + +-#ifdef DEBUG +- virtual int32_t GetWidth() const override; +- virtual int32_t GetHeight() const override; +-#endif ++ virtual int32_t GetWidth() const override; ++ virtual int32_t GetHeight() const override; ++ + // nsICanvasRenderingContextInternal + /** + * Gets the pres shell from either the canvas element or the doc shell +diff --git a/dom/canvas/WebGLContext.cpp b/dom/canvas/WebGLContext.cpp +index 1c22c27..f2a620a 100644 +--- a/dom/canvas/WebGLContext.cpp ++++ b/dom/canvas/WebGLContext.cpp +@@ -463,7 +463,6 @@ WebGLContext::SetContextOptions(JSContext* cx, JS::Handle<JS::Value> options) + return NS_OK; + } + +-#ifdef DEBUG + int32_t + WebGLContext::GetWidth() const + { +@@ -475,7 +474,6 @@ WebGLContext::GetHeight() const + { + return mHeight; + } +-#endif + + /* So there are a number of points of failure here. We might fail based + * on EGL vs. WGL, or we might fail to alloc a too-large size, or we +diff --git a/dom/canvas/WebGLContext.h b/dom/canvas/WebGLContext.h +index 63c4091..210f341 100644 +--- a/dom/canvas/WebGLContext.h ++++ b/dom/canvas/WebGLContext.h +@@ -202,10 +202,9 @@ public: + NS_DECL_NSIDOMWEBGLRENDERINGCONTEXT + + // nsICanvasRenderingContextInternal +-#ifdef DEBUG + virtual int32_t GetWidth() const override; + virtual int32_t GetHeight() const override; +-#endif ++ + NS_IMETHOD SetDimensions(int32_t width, int32_t height) override; + NS_IMETHOD InitializeWithSurface(nsIDocShell*, gfxASurface*, int32_t, + int32_t) override +diff --git a/dom/canvas/nsICanvasRenderingContextInternal.h b/dom/canvas/nsICanvasRenderingContextInternal.h +index 3b1120f..fb1ef7c 100644 +--- a/dom/canvas/nsICanvasRenderingContextInternal.h ++++ b/dom/canvas/nsICanvasRenderingContextInternal.h +@@ -81,11 +81,9 @@ public: + return mCanvasElement; + } + +-#ifdef DEBUG +- // Useful for testing +- virtual int32_t GetWidth() const = 0; +- virtual int32_t GetHeight() const = 0; +-#endif ++ // Dimensions of the canvas, in pixels. ++ virtual int32_t GetWidth() const = 0; ++ virtual int32_t GetHeight() const = 0; + + // Sets the dimensions of the canvas, in pixels. Called + // whenever the size of the element changes. +diff --git a/dom/html/HTMLCanvasElement.cpp b/dom/html/HTMLCanvasElement.cpp +index f326662..68649f5 100644 +--- a/dom/html/HTMLCanvasElement.cpp ++++ b/dom/html/HTMLCanvasElement.cpp +@@ -526,18 +526,19 @@ HTMLCanvasElement::ToBlob(JSContext* aCx, + return; + } + +-#ifdef DEBUG + if (mCurrentContext) { + // We disallow canvases of width or height zero, and set them to 1, so + // we will have a discrepancy with the sizes of the canvas and the context. + // That discrepancy is OK, the rest are not. + nsIntSize elementSize = GetWidthHeight(); +- MOZ_ASSERT(elementSize.width == mCurrentContext->GetWidth() || +- (elementSize.width == 0 && mCurrentContext->GetWidth() == 1)); +- MOZ_ASSERT(elementSize.height == mCurrentContext->GetHeight() || +- (elementSize.height == 0 && mCurrentContext->GetHeight() == 1)); ++ if ((elementSize.width != mCurrentContext->GetWidth() && ++ (elementSize.width != 0 || mCurrentContext->GetWidth() != 1)) || ++ (elementSize.height != mCurrentContext->GetHeight() && ++ (elementSize.height != 0 || mCurrentContext->GetHeight() != 1))) { ++ aRv.Throw(NS_ERROR_FAILURE); ++ return; ++ } + } +-#endif + + uint8_t* imageBuffer = nullptr; + int32_t format = 0; +-- +2.5.0 + |