Bug 1347617 - In SVG ConvolveMatrix code, bail out if kernelUnitLength is negative or zero. r=dholbert, a=lizzard
authorvincentliu <vliu@mozilla.com>
Thu, 06 Apr 2017 15:40:35 -0400
changeset 379486 3972c6e42982804732a7bd52bc693e04f5f2186f
parent 379485 15eeffc957863531c7fc42ef8b0a39406b0a195e
child 379487 da09e3a7615530b3267a52549e7ed68c17088e2d
push id1419
push userjlund@mozilla.com
push dateMon, 10 Apr 2017 20:44:07 +0000
treeherdermozilla-release@5e6801b73ef6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdholbert, lizzard
bugs1347617
milestone53.0
Bug 1347617 - In SVG ConvolveMatrix code, bail out if kernelUnitLength is negative or zero. r=dholbert, a=lizzard
dom/svg/SVGFEConvolveMatrixElement.cpp
--- a/dom/svg/SVGFEConvolveMatrixElement.cpp
+++ b/dom/svg/SVGFEConvolveMatrixElement.cpp
@@ -227,16 +227,22 @@ SVGFEConvolveMatrixElement::GetPrimitive
 
   uint32_t edgeMode = mEnumAttributes[EDGEMODE].GetAnimValue();
   bool preserveAlpha = mBooleanAttributes[PRESERVEALPHA].GetAnimValue();
   float bias = mNumberAttributes[BIAS].GetAnimValue();
 
   Size kernelUnitLength =
     GetKernelUnitLength(aInstance, &mNumberPairAttributes[KERNEL_UNIT_LENGTH]);
 
+  if (kernelUnitLength.width <= 0 || kernelUnitLength.height <= 0) {
+    // According to spec, A negative or zero value is an error. See link below for details.
+    // https://www.w3.org/TR/SVG/filters.html#feConvolveMatrixElementKernelUnitLengthAttribute
+    return failureDescription;
+  }
+
   FilterPrimitiveDescription descr(PrimitiveType::ConvolveMatrix);
   AttributeMap& atts = descr.Attributes();
   atts.Set(eConvolveMatrixKernelSize, IntSize(orderX, orderY));
   atts.Set(eConvolveMatrixKernelMatrix, &kernelMatrix[0], kmLength);
   atts.Set(eConvolveMatrixDivisor, divisor);
   atts.Set(eConvolveMatrixBias, bias);
   atts.Set(eConvolveMatrixTarget, IntPoint(targetX, targetY));
   atts.Set(eConvolveMatrixEdgeMode, edgeMode);