Bug 1347617 - In SVG ConvolveMatrix code, bail out if kernelUnitLength is negative or zero. r=dholbert, a=lizzard
authorvincentliu <vliu@mozilla.com>
Thu, 06 Apr 2017 15:40:35 -0400
changeset 395748 8ddc4fb22781c63038b3957d2e64b5bfd84328ba
parent 395747 3f67a4d375a17ece4f0a3cb108703ab3f39e060b
child 395749 92ba21762445f89ae0691c4eab0746ca1cb819c2
push id1468
push userasasaki@mozilla.com
push dateMon, 05 Jun 2017 19:31:07 +0000
treeherdermozilla-release@0641fc6ee9d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdholbert, lizzard
bugs1347617
milestone54.0a2
Bug 1347617 - In SVG ConvolveMatrix code, bail out if kernelUnitLength is negative or zero. r=dholbert, a=lizzard
dom/svg/SVGFEConvolveMatrixElement.cpp
--- a/dom/svg/SVGFEConvolveMatrixElement.cpp
+++ b/dom/svg/SVGFEConvolveMatrixElement.cpp
@@ -227,16 +227,22 @@ SVGFEConvolveMatrixElement::GetPrimitive
 
   uint32_t edgeMode = mEnumAttributes[EDGEMODE].GetAnimValue();
   bool preserveAlpha = mBooleanAttributes[PRESERVEALPHA].GetAnimValue();
   float bias = mNumberAttributes[BIAS].GetAnimValue();
 
   Size kernelUnitLength =
     GetKernelUnitLength(aInstance, &mNumberPairAttributes[KERNEL_UNIT_LENGTH]);
 
+  if (kernelUnitLength.width <= 0 || kernelUnitLength.height <= 0) {
+    // According to spec, A negative or zero value is an error. See link below for details.
+    // https://www.w3.org/TR/SVG/filters.html#feConvolveMatrixElementKernelUnitLengthAttribute
+    return failureDescription;
+  }
+
   FilterPrimitiveDescription descr(PrimitiveType::ConvolveMatrix);
   AttributeMap& atts = descr.Attributes();
   atts.Set(eConvolveMatrixKernelSize, IntSize(orderX, orderY));
   atts.Set(eConvolveMatrixKernelMatrix, &kernelMatrix[0], kmLength);
   atts.Set(eConvolveMatrixDivisor, divisor);
   atts.Set(eConvolveMatrixBias, bias);
   atts.Set(eConvolveMatrixTarget, IntPoint(targetX, targetY));
   atts.Set(eConvolveMatrixEdgeMode, edgeMode);