diff options
| author | Juanmi Huertas <juanmihd@chromium.org> | 2020-04-07 14:25:12 +0000 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2020-07-29 10:52:37 +0000 |
| commit | 1cf3807d934912aec23a22d10dcedb0773f75eca (patch) | |
| tree | 406cf3b6f52b668994f064459269ba3426d76406 | |
| parent | cc32214f8dc1268ed0de951c16746b86df0f2257 (diff) | |
| download | qtwebengine-chromium-1cf3807d934912aec23a22d10dcedb0773f75eca.tar.gz | |
[Backport] Security bug 1052492
Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/2134662:
Adding a new MSAN check to validate if the skImage is initialized
ImageDataBuffer may trying to be copying an uninitialized SkImage.
Adding an MSAN check to check before doing the copy to ensure that has
been initialized.
Bug: 1052492
Change-Id: I6cfefffe42f5cf11eaf5119df1352338c2b00010
Commit-Queue: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Fernando Serboncini <fserb@chromium.org>
Auto-Submit: Juanmi Huertas <juanmihd@chromium.org>
Cr-Commit-Position: refs/heads/master@{#757045}
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
| -rw-r--r-- | chromium/third_party/blink/renderer/platform/graphics/image_data_buffer.cc | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/chromium/third_party/blink/renderer/platform/graphics/image_data_buffer.cc b/chromium/third_party/blink/renderer/platform/graphics/image_data_buffer.cc index fe622fba3ae..9abb2b2747e 100644 --- a/chromium/third_party/blink/renderer/platform/graphics/image_data_buffer.cc +++ b/chromium/third_party/blink/renderer/platform/graphics/image_data_buffer.cc @@ -54,6 +54,13 @@ ImageDataBuffer::ImageDataBuffer(scoped_refptr<StaticBitmapImage> image) { retained_image_ = image->PaintImageForCurrentFrame().GetSkImage(); if (!retained_image_) return; +#if defined(MEMORY_SANITIZER) + // Test if retained_image has an initialized pixmap. + SkPixmap pixmap; + if (retained_image_->peekPixels(&pixmap)) + MSAN_CHECK_MEM_IS_INITIALIZED(pixmap.addr(), pixmap.computeByteSize()); +#endif + if (retained_image_->isTextureBacked() || retained_image_->isLazyGenerated() || retained_image_->alphaType() != kUnpremul_SkAlphaType) { |