Bug 1279628, part 1 - Add the CoreGraphics check from gfxASurface::CheckSurfaceSize to Factory::CheckSurfaceSize. r=mstange
☠☠ backed out by 72577f72121a ☠ ☠
authorJonathan Watt <jwatt@jwatt.org>
Thu, 09 Jun 2016 15:31:24 +0100
changeset 377744 416fa9aeec559b964f29097b203e088ece5d2095
parent 377743 83ddd65acc826af36de5032eb2f3effaf60809cb
child 377745 07e4432bd6b312a8191b084e2ac064df0d45d29a
push id20857
push userbmo:james@hoppipolla.co.uk
push dateSun, 12 Jun 2016 16:59:39 +0000
reviewersmstange
bugs1279628
milestone50.0a1
Bug 1279628, part 1 - Add the CoreGraphics check from gfxASurface::CheckSurfaceSize to Factory::CheckSurfaceSize. r=mstange
gfx/2d/Factory.cpp
--- a/gfx/2d/Factory.cpp
+++ b/gfx/2d/Factory.cpp
@@ -260,16 +260,25 @@ Factory::CheckSurfaceSize(const IntSize 
   }
 
   // reject images with sides bigger than limit
   if (extentLimit && (sz.width > extentLimit || sz.height > extentLimit)) {
     gfxDebug() << "Surface size too large (exceeds extent limit)!";
     return false;
   }
 
+#if defined(XP_MACOSX)
+  // CoreGraphics is limited to images < 32K in *height*,
+  // so clamp all surfaces on the Mac to that height
+  if (sz.height > SHRT_MAX) {
+    gfxDebug() << "Surface size too large (exceeds CoreGraphics limit)!";
+    return false;
+  }
+#endif
+
   // make sure the surface area doesn't overflow a int32_t
   CheckedInt<int32_t> tmp = sz.width;
   tmp *= sz.height;
   if (!tmp.isValid()) {
     gfxDebug() << "Surface size too large (would overflow)!";
     return false;
   }